How to make a Tor relays ORPort and DirPort reachable?

Question

I've been trying to set up a tor relay with a Raspberry Pi. It runs Raspbian GNU/Linux 9 and Tor 0.2.9.16.

Since I only want to use the Raspberry for the tor relay I didn't do much. After installing Raspbian, I set up SSH and installed tor. I have configured a static IP address via my router and forwarded the needed ports (see below).

In order to monitor my relay I installed a tool called nyx afterwards. It's mentioned in The Tor Relay Guide.

When I start Tor now the expected entries appear in the log.

Also this message:

Tor has successfully opened a circuit. Looks like your client functionality is working.

But after a few minutes (and later in a 20-minute interval) the following entries appear in the log:

[WARN] Your server (xx.xx.xx.xxx:9030) has not managed to confirm that its DirPort is reachable. Relays do not publish descriptors until their ORPort and DirPort are reachable. Please check your firewalls, ports, adress, /etc/hosts file, etc.

And:

[WARN] Your server (xx.xx.xx.xxx:9001) has not managed to confirm that its ORPort is reachable. Relays do not publish descriptors until their ORPort and DirPort are reachable. Please check your firewalls, ports, adress, /etc/hosts file, etc.

I dont't know why these warnings are coming up. Especially since I see with nyx connections appearing and data being transferred.

This is the configuration in my /etc/tor/torrc-file (I have exchanged the nickname and the contact info with abcd in this post):

SocksPort 0
RunAsDaemon 1
DirPort 9030
ORPort 9001
Nickname abcd
ContactInfo abcd
Log notice file /var/log/tor/notices.log
ExitPolicy reject *:*
ControlPort 9051
CookieAuthentication 1

And with my router (Fritz!Box 6490 Cable) I have enabled port forwarding for these ports:

I know that similar questions have already been asked and can be found relatively quickly on the Internet, but none of the answers have helped me so far, so I ask here.

I have no idea why the error messages appear and how to solve the problem. If anyone has an idea, please, let me know.

Answer 1

I think you are looking for NoAdvertise and NoListen flags. The manual says:

ORPort [address:]PORT|auto [flags]
    Advertise this port to listen for connections from Tor clients and
    servers. This option is required to be a Tor server. Set it to
    "auto" to have Tor pick a port for you. Set it to 0 to not run an
    ORPort at all. This option can occur more than once. (Default: 0)

    Tor recognizes these flags on each ORPort:

    **NoAdvertise**::
    By default, we bind to a port and tell our users about it. If
    NoAdvertise is specified, we don't advertise, but listen anyway.
    This can be useful if the port everybody will be connecting to
    (for example, one that's opened on our firewall) is somewhere else.

    **NoListen**::
    By default, we bind to a port and tell our users about it. If
    NoListen is specified, we don't bind, but advertise anyway.  This
    can be useful if something else  (for example, a firewall's port
    forwarding configuration) is causing connections to reach us.

So I would rewrite the following two lines:

DirPort 9030
ORPort 9001

to:

DirPort 9030 NoAdvertise
DirPort <your external ip address>:9030 NoListen
ORPort 9001 NoAdvertise
ORPort <your external ip address>:9001 NoListen

which would listen locally but wouldn't advertise (unreachable) local address to dir authorities and would advertise the ports forwarded from your external router interface.

This of course assumes that your router is assigned static, globally routable IPv4 address by your ISP. If this is not the case you are unlikely to be able to run tor relay.

Answer 2

Try the following within /etc/tor/torrc config-file (using your subject port-numbers)

ORPort 9001
0RPort 9001 NoListen
DirPort 9030 NoAdvertise

Ensure that you updated the host-fire wall params within ufw and the port-forwarding rules for the network-router; this resolved my related issue to the subject question.