1

Let us say, a client with Tor browser tries to connect to my .onion web-server, both the client and the server will create Tor circuits and meet at the Rendezvous-Point, for now I hope I'm right.

The client to see my webpage will send a GET HTTP REQUEST, this request will go over 6 tor nodes, when the last node send the packet to my home router, how will my home router (or server firewall) accept it since it's in-going connection?

In the articles they say that both client and server connections are outgoing, but i just don't understand it when obviously at some point my server will receive requests from the outside.

2 Answers 2

2

In the articles they say that both client and server connections are outgoing, but i just don't understand it when obviously at some point my server will receive requests from the outside.

Requests are different than connections. A connection refers to the TCP connection and a request refers to the HTTP request. In Tor there are many connections in many different directions.

When they talk about an incoming or outgoing connection, they are referring to the direction of the original TCP connection. For example when a client connects to a regular web server, the client opens an outgoing TCP connection to the server and the server accepts this incoming TCP connection. Data flows in both directions as the client sends the HTTP request and receives the response.

This is not how it works with onion services. With onion services, both the client and server run Tor proxies. These Tor proxies each make a single outgoing TCP connection to the Tor network as part of their circuits to the rendezvous point, and the rendezvous point connects the circuits together. Data that is sent from the client will travel through this circuit and pass through the rendezvous relay on its way to the onion service.

Since the firewall sits between the Tor proxy and the Tor network, and the Tor proxy makes an outgoing connection to the Tor network, this is an outgoing connection from the onion service to the Internet. Even though the onion service is receiving the HTTP request, that does not mean that it's an incoming connection. The connection is the original outgoing TCP connection that the onion service made to the Tor network. In this case you can think of the HTTP request traveling "backwards" along the server Tor proxy's outgoing TCP connection.

0

When someone opens an .onion link, it goes over a Tor circuit to the rendezvous point as you said. The computer which hosts the Tor Onion service and the web server also needs to maintain a Tor circuit. So, in a way, this computer acts also as a Tor client and as long as it is possible for the machine to have an outgoing Tor connection it can also work as Tor onion service. Maybe the image below clarifies it a bit.

The Tor Project has an overview page for Onion Services. The image below is from the page:

Last step of building an onion service connection

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .