I'm trying to setup Tor Exit Node but I'm behind CG-NAT. I came across the idea of port-forwarding my local ORPort to a VPS which has Public IP and is accessible to world.
For communication between my local PC (hosting Tor node) and VPS, I use tailscale which just works out of the box. I installed tailscale on both devices and ORPort is accessible to VPS. Here is the diagram to simplify it:
To make TOR work, the port must be accessible publicly on given Public IP. It fails to do Self-check. Below is the diagram depicting expected behavior
I have tired setting up Nginx
, Envoy
, iptables
, socat
on VPS but none of them seem to work with ORPort
Socat
socat TCP-LISTEN:9029,fork,reuseaddr TCP:100.72.86.30:9029
iptables
iptables -I FORWARD -d 100.72.86.30 -m tcp -p tcp --dport 9029 -j ACCEPT
iptables -t nat -I PREROUTING -m tcp -p tcp ! -i tailscale0 --dport 9029 -j DNAT --to-destination 100.72.86.30:9029
iptables -t nat -I POSTROUTING -d 100.72.86.30 -o tailscale0 -j MASQUERADE
I feel port-forwarding is working but something is there in ORPort maybe a security thing that is not allowing it to accept connections.
I know that there is no configuration issue because the same works if I directly run on VPS. It is configured to accept traffic from 0.0.0.0
Update
I tried reducing the route to find the root cause of it. I'm running tor on VPS along with haproxy. When I put haproxy port for advertising, self-check doesn't pass. However, if I start advertising tor's actual orport then it passes. What a weird behavior. From tcpdump, I can see tor is receiving connection in both conditions but haproxy is just not passing.
I'm stuck on it for over a week. Any help will be appreciated 🙂