Recently I started to run a bridge on some dedicated machine. Even it is used a bit the machine has a very low load and I was thinking about placing two or more bridges on it. Is this possible and recommended? Can you provide some insights about the best way to do it (run them on different ports, use LXC or another virtualisation technology etc.)?
asked Oct 3, 2013 at 14:21
-
1Do you have more than one IP address available?– weasel - Peter PalfraderCommented Oct 3, 2013 at 14:44
-
Depending on the system, yes. But they are 'neighbour' IPs (like .11, .12, .13, .14; usually all in the same /28)– Jens KubiezielCommented Oct 3, 2013 at 15:30
Add a comment
|
2 Answers
If by "best" you mean some combination of "most censorship resistant" and "provide the most bandwidth where it is needed"...
If you only have access to one external IP address, the best way to run multiple bridges on a single computer would be to run multiple types of pluggable transport bridges on different ports. Since you have multiple IP addresses available, it would be better to run separate pluggable transport bridges on separate IPs.
The most effective transport to run right now, in terms of most user demand and least number of countries known to be capable of detecting and blocking it, is obfsproxy using the obfs3 protocol (instructions for setting one up can be found on that page also).
The reason for this is that multiple censoring countries/parties have been known to blackhole IP addresses. There are some known cases of IP:port pairs being censored, with some unverified reports that IP:ports are blocked if there is another resource being served from the same IP (such as a webserver, jabber server, etc.). In general though, I would say that once a censoring party is made aware of a Tor bridge, that they will block it on the IP layer. Therefore, using different IPs, if you have them, is likely the most effective strategy.
For more information on the technical mechanisms of censorship practised by various countries, see the censorship wiki page.
-
1(I couldn't put more than 2 links in my answer because I don't have enough of points on this account...) For more information on the technical mechanisms of censorship practised by various countries, see [the censorship wiki page][1]. [1]: trac.torproject.org/projects/tor/wiki/doc/OONI/censorshipwiki– isisCommented Oct 7, 2013 at 20:08
-
If you only have a single address, then the answer probably depends on how bridges are blocked.
If the adversary blocks entire hosts because they find a bridge on it, then running more on the same IP address provides little advantage. If, however, they only block the specific address:port combination, then more are better.
I don't know if we have any data on what blockers do, but my guess is that it's the former. As such, running more bridges on the same address probably doesn't help much or anything.
If you have lots of addresses, then by all means, run bridges on all of them.
answered Oct 3, 2013 at 14:58
