6

Why is it still required have two open ports, DirPort and OrPort, for a relay?

Imagine such a situation. A Tor user with unlimited network traffic and with that kind great bandwidth stay behind a NAT router without the ability to forward two ports, or e.g. no external IP address in the provider's VPN configuration, or public modern Wi-Fi cafe, etc...

It is obvious that the anonymity of a relay operator, while browsing, is much better than the client's.

This should be enabled by default for high-bandwidth connections.

Why do I point out the possibility of incoming traffic to such a middle-relay? I'm just fortuitously found for myself, that the onion hidden service isn't required in any open ports.

In the same way, with only one hop, not a three hops, any relay behind the NAT router would share its bandwidth with the network. That means, the bandwidth of the whole network will grow 100 times and the anonymity of such clients-middle-relays will grow!

Complexity of code for this is +100 lines at maximum.

Current state is: 5,000 relays vs 500,000 clients, 1 x 100.

Under "Middle-relay", I mean ExitPolicy reject *:*

Improve this question
3
  • 1
    It's much better if you only ask one questions each time. open another question for "What is the lowest bandwidth rate limit required for a normal middle relay?" part perhaps?
    – mrphs
    Commented Oct 5, 2013 at 7:40
  • 1
    Please clarify the question. Are you asking whether middle relays could operate as hidden services, and be found using their .onion addresses? There's more than a little recursion problem there, in that you'd need working circuits to create circuits with hidden services. And there's also the problem, alluded to by Peter Palfrader aka weasel, that this would vastly reduce the cost of attacks.
    – mirimir
    Commented Oct 6, 2013 at 8:24
  • 1
    Make that "... perhaps alluded to ...".
    – mirimir
    Commented Oct 6, 2013 at 8:46

3 Answers 3

Reset to default
5

Right now, Tor depends on the fact that all clients and all servers can contact all servers.

Once you add relays that are not reachable from the Internet because they are behind NAT for instance, this will no longer be true. This would making arguing about Tor's security properties way harder.

Somebody would have to come up with a design and its implications would have to be studied in detail before such a change could be made.

Improve this answer
4

See also this report:

Jacob Appelbaum. Tor and NAT devices: increasing bridge & relay reachability or, enabling the use of NAT-PMP and UPnP by default (Technical Report 2012-08-001, The Tor Project, August 2012.)

Improve this answer
3

I'm not sure if I understand your question correctly, but if you can't have any incoming connection then you can't run a relay. A non-exit relay has to be able to send/receive data within Tor network.

And that ExitPolicy reject *:* which is the correct setting for a non-exit relay means it will accept any connection in and out.

If you're running a non-exit relay, it eventually becomes a middle node.

And if you're talking about every-user-a-relay, you should read this.

Improve this answer
1
  • I point on possibility in incoming connection the same way as HS get connection, but with one-hop, not three.
    – perpetuity
    Commented Oct 9, 2013 at 8:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .