Access ORPort via tailscale

Question

I'm trying to setup Tor Exit Node but I'm behind CG-NAT. I came across the idea of port-forwarding my local ORPort to a VPS which has Public IP and is accessible to world.

For communication between my local PC (hosting Tor node) and VPS, I use tailscale which just works out of the box. I installed tailscale on both devices and ORPort is accessible to VPS. Here is the diagram to simplify it:

To make TOR work, the port must be accessible publicly on given Public IP. It fails to do Self-check. Below is the diagram depicting expected behavior

I have tired setting up Nginx, Envoy, iptables, socat on VPS but none of them seem to work with ORPort

Socat

socat TCP-LISTEN:9029,fork,reuseaddr TCP:100.72.86.30:9029

iptables

iptables -I FORWARD -d 100.72.86.30 -m tcp -p tcp --dport 9029 -j ACCEPT 
iptables -t nat -I PREROUTING -m tcp -p tcp ! -i tailscale0 --dport 9029 -j DNAT --to-destination 100.72.86.30:9029
iptables -t nat -I POSTROUTING -d 100.72.86.30 -o tailscale0 -j MASQUERADE

I feel port-forwarding is working but something is there in ORPort maybe a security thing that is not allowing it to accept connections.

I know that there is no configuration issue because the same works if I directly run on VPS. It is configured to accept traffic from 0.0.0.0

Update

I tried reducing the route to find the root cause of it. I'm running tor on VPS along with haproxy. When I put haproxy port for advertising, self-check doesn't pass. However, if I start advertising tor's actual orport then it passes. What a weird behavior. From tcpdump, I can see tor is receiving connection in both conditions but haproxy is just not passing.

I'm stuck on it for over a week. Any help will be appreciated 🙂

Answer 1

Try setting the Address option in your torrc file to the public address of your VPS. From the tor man page:

Address address
     The IPv4 address of this server, or a fully qualified domain name of this server that resolves to an IPv4 address. You can leave this unset, and
     Tor will try to guess your IPv4 address. This IPv4 address is the one used to tell clients and other servers where to find your Tor server; it
     doesn’t affect the address that your server binds to. To bind to a different address, use the ORPort and OutboundBindAddress options.

Answer 2

Tailscale is not the right choice to do it out of the box and you need it vice versa: you need to use OpenVPN from your NAT'ed box to the VPS and the client here should be a NAT'ed box. After that just forward the port VPS->NATed via static OpenVPN internal IP's and make the NAT for tor process user through the VPN tunnel. Then self-check will succeed and everything else will work out of the box. Don't forget to bind ORPort to the VPN internal IP and set the external address of your VPS server in your torrc !