8

Running a hidden service in a secure way can be a really complicated matter.

Ideally the system where the hidden service software (e.g. a web server) lives should not have a publicly routable IP address on any of its network interfaces and should not be able to learn its real public IP address. That leaves out the solution of NAT since a system behind NAT although has not a publicly routable address can easily find its real address.

A solution would be an isolated system with all its connections routed through Tor. For example another box running Tor could server as middle-box/router for the isolated hidden service host.

If a user followed the traditional way to set up a hidden service in the isolated box then she would end up running Tor in both machines, routing one tor instance though another thus having terrible effects on latency and bandwidth.

My question is : could the user run the hidden service's software for example an Apache Web Server instance in a box different than the one running the Tor instance ?

If not, is there any other feasible solution that could fit the scheme described above?

Improve this question
2
  • Please do not run Tor over Tor: trac.torproject.org/projects/tor/wiki/doc/…
    – zhenech
    Oct 3, 2013 at 10:16
  • I would love to add that info, about Tor over Tor, I would just prefer some other source than Tor's wiki, which is very open and sometimes inaccurate.
    – alaf
    Oct 3, 2013 at 13:07

2 Answers 2

Reset to default
4

Sure, just configure your hidden service with the external IP, eg:

HiddenServicePort 80 192.168.1.10:8080

Where 192.168.1.10 is the server running your hidden service (on port 8080 in this example which will be exposed via the hidden service on port 80).

If for some reason you didn't want to do that, you could always port forward to the external host's port to your local port via nc, ssh, iptables, or any other software people use to forward ports.

Improve this answer
6
  • You would run Tor on a machine with (at least) two network adaptors. One (eth0 let's say) would be connected to a LAN with Internet access. Ideally, it would not be your main LAN (at least a dedicated vLAN). You'd route to the Tor client through the second adaptor (eth1 let's say) from a separate LAN, with iptables rules to prevent leaks.
    – mirimir
    Oct 3, 2013 at 1:50
  • Or just get a good switch and vlan everything off :) there are lots of good ways you could setup the network, but I think that's straying a bit off topic.
    – user5
    Oct 3, 2013 at 1:55
  • Combining iptables, pf etc (Tor router) and vLANs, which is the weakest link? Also, what's the most secure OS for Tor routers? Examples that come to mind are Debian, OpenWRT and FreeBSD.
    – mirimir
    Oct 3, 2013 at 2:56
  • There's nothing stopping you from doing this without any routing on the host itself. You can just start a Tor instance on any host on the Internet and be a hidden service for anything you can reach over the Internet. If you wanted, you could for instance run a hidden service for www.torproject.org.
    – weasel - Peter Palfrader
    Oct 3, 2013 at 6:12
  • Thanks, Peter. I'm more than normally paranoid these days ;) All that matters is that the server can't see the Internet except through the Tor gateway. If the Tor client on the gateway router dies, nothing can get through. Is that right?
    – mirimir
    Oct 3, 2013 at 7:09
3

Yes, you could do that. There are probably multiple ways to do this, but the first that comes to mind is:

  • Run a hidden service that is a reverse proxy to the machine that runs the Apache instance. This machine should accept only connections from the tor network.

  • Make sure the other machine, the one that runs the Apache instance, can accept connections only from the reverse proxy. One way to do this is to run Apache on a virtualized host, and firewall it from outside the virtual machine. You can use a VPN for the communication between the two machines.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .