2

I run a relay in my home network. The relay runs on my router (self build opnsense machine). Details of my relay indicate that initially it progressed the usual live cycle of a relay. Then all connections drop. Consensus rates dropped and it stopped being chosen as guard. It changes to Unmeasured Nothing has been changed on the end of configuration or internet connection. The advertised bandwidth stayed roughly the same (I have 200MBit cable and ususally do get the full speed; the relay is not restricted on bandwidth-use).

In comparison: a relay that I ran until July last year with the same configuration never suffered this behavior.

Any help is dearly appreciated! Thank you.

  • 1
    Your relay seems to be getting a low consensus weight since a majority of the bandwidth authorities are measuring your relay (warning: large webpage size) as having a low bandwidth. I'm not sure why this is the case, if you're familiar with Python you could try using the stem library to build a circuit through your relay and test the performance. If no one answers here, you might get more help on the #tor-relays irc channel on OFTC. – Steve Mar 22 at 6:34
  • Thanks alot for your insights and for the link. This is strange since I ususally have 200Mbit down and 50 Mbit upstream available. I'll look into it -- my python skills are not existent so I'lL have to pass on your troubleshooting suggestions. – HATEthePLOT Mar 22 at 19:35
  • I just wrote a script to test relays and I'm only able to create circuits if your relay is the first hop (the guard). If I attempt to create a circuit with your relay as the middle, the circuit times out. If I replace your relay with another relay, the circuit builds fine. Maybe double check your firewall rules? Is your public IP address on any IP blacklists? – Steve Mar 25 at 19:20
  • Thank you for your effort in testing. I serached and found my public IP on github.com/firehol/blocklist-ipsets/blob/master/dm_tor blocklist. The odd thing is that it used to work -- and without changes to config, ports, etc. it stopped. – HATEthePLOT Mar 26 at 7:42
2

I have run a Tor relay for fifteen years, and I am seeing a similar issue with my relay. For privacy reasons, I apologize in advance for not listing my relay's nickname. According to Tor Metrics, on 2020-02-26 both my relay and your relay began receiving a Consensus Weight of 20 (Additional Flag: Unmeasured). Both of our relays are non-exit, middle-nodes with similar Advertised Bandwidth. The Exit Policy reject configuration is identical. Your relay has one Alleged Family Member, but my relay does not. Both of our relays are IPv4 only. My relay is in the US, and yours is in Germany. Your Consensus Weight shows a steady value of 20 over the past month, but mine has fluctuated approximately every three days between a normal (for my relay) Consensus Weight and 20 (effectively unmeasured), and this has been going on since 2020-02-26. I made no changes to my relay or network configuration immediately before the issue.

I have been watching Consensus Health for my relay daily over the past month. My relay is always measured by bwauth moria1 and bwauth faravahar. Occasionally, my relay is also measured by bwauth bastet with a bw=20. For my relay, I think bastet is part of the problem.

Unlike many other relays, my relay is not being measured by either bwauth maatuska or bwauth longclaw. This unmeasured state is not helping my relay's Consensus Weight.

On 2020-02-26, my relay was running Tor 0.4.2.5 on Linux, but I updated it to 0.4.2.6 a few days later.

My flags have been constant over the past month: Fast, Running, Stable, V2Dir, Valid, and HSDir (except for after Tor restarts and Linux kernel update/reboots).

My relay is behind a highly restrictive (ingress and egress) firewall, but all of the published dirauth and bwauth servers are allowed. This has been in place for years, and there have been no published dirauth and/or bwauth changes (server, IP address, port) that I can find.

According to Sebastian Hahn, there is a recent issue with bwauth gabelmoo: https://lists.torproject.org/pipermail/tor-relays/2020-March/018241.html

I realize that this does not solve your issue, but I thought we could compare notes.

|improve this answer|||||
  • Thank you for your input! It is odd that we both can pinpoint the date when the problems start. The new family member was added after my post here to rule out config/hardware issues. I just kept it running for the last week or so. – HATEthePLOT Mar 25 at 11:23
  • I noticed another semi-commonality. You mentioned OPNsense which I understand is a fork of pfSense. My relay is running behind a pfSense router/firewall. Is your relay running behind either OPNsense or pfSense? – tirvgqnf Mar 25 at 20:28
  • Note that relays are allowed to use any ports they want, so blocking egress ports will cause circuits to fail as you'll be unable to connect to many other relays. For example common OR ports are: 9100, 9010, 9001, 80, 443, etc. If bandwidth authorities are unable to build a circuit through your relay, you'll end up with a low consensus weight. – Steve Mar 25 at 20:46
  • Steve, thank you for the reminder to review the list of relays and their ports. I used the following (warning for large page): torstatus.rueckgr.at/index.php?SR=ORPort&SO=Desc When I started running a relay, the majority of relay ORPorts were on TCP port 9001, but over the years that has changed. – tirvgqnf 2 hours ago
0

HATEthePLOT, the problem with my relay appears to be corrected. All five active bwauth servers are measuring my relay. The three bwauth servers that were previously egress blocked by my firewall (pfSense) are measuring my relay at a low number, but I think this may be part of the lifecycle of a new relay:

https://blog.torproject.org/lifecycle-new-relay

Perhaps in a couple of weeks, my relay will be working better than ever.

Basically, I performed the following:

1) On the Linux server running the relay, I added Netfilter/iptables rules to block egress unless it was localhost, local network traffic, or from the service account running Tor.

2) On pfSense for the private IP address of the Linux server running Tor, I removed the egress rule port restrictions of TCP port 9001 and TCP port 9030.

3) I restarted the Linux server running Tor.


Following is a more detailed list of my Netfilter/iptables changes.

The Tor Project suggests "Blocking all local outbound non-Tor traffic with iptables":

https://trac.torproject.org/projects/tor/wiki/doc/BlockingNonTorTraffic

# iptables -F OUTPUT
# iptables -A OUTPUT -j ACCEPT -m owner --uid-owner debian-tor
# iptables -A OUTPUT -j ACCEPT -o lo
# iptables -A OUTPUT -j ACCEPT -p udp --dport 123
# iptables -P OUTPUT DROP
# iptables -L -v

Instead, with the assumption that the service account is "debian-tor", and the local network is "192.168.0.0/24", I used the following for Linux Mint 19.1:

sudo apt-get update && sudo apt-get install iptables-persistent netfilter-persistent

sudo iptables --list --line-numbers --verbose --exact
sudo iptables --flush INPUT
sudo iptables --append INPUT --jump ACCEPT --match state --state RELATED,ESTABLISHED
sudo iptables --append INPUT --jump ACCEPT --in-interface lo
sudo iptables --append INPUT --jump ACCEPT --source 192.168.0.0/24
sudo iptables --append INPUT --jump ACCEPT --protocol tcp --dport 9001
sudo iptables --append INPUT --jump ACCEPT --protocol tcp --dport 9030
sudo iptables --policy INPUT ACCEPT
sudo iptables --list --line-numbers --verbose --exact
sudo netfilter-persistent save

sudo iptables --list --line-numbers --verbose --exact
sudo iptables --flush OUTPUT
sudo iptables --append OUTPUT --jump ACCEPT --match state --state RELATED,ESTABLISHED
sudo iptables --append OUTPUT --jump ACCEPT --out-interface lo
sudo iptables --append OUTPUT --jump ACCEPT --destination 192.168.0.0/24
sudo iptables --append OUTPUT --jump ACCEPT --match owner --uid-owner debian-tor
# sudo iptables --append OUTPUT --jump LOG --log-prefix "iptables_DROP: "
sudo iptables --policy OUTPUT DROP
sudo iptables --list --line-numbers --verbose --exact
sudo netfilter-persistent save

sudo shutdown -r now

sudo iptables --zero

sudo watch iptables --list --line-numbers --verbose --exact

journalctl -fk -o short-iso

Please note that while I have created corresponding INPUT rules, my chain INPUT is using policy ACCEPT (blocking nothing for ingress). pfSense can handle ingress well enough, and Netfilter/iptables appears to be blocking non-Tor related egress traffic as expected.

I commented the LOG statement, but you can use it to troubleshoot DROP actions, if necessary.

HATEthePLOT, I hope this helps with your relay's issue.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.