2

If I'm running Tor and a hidden .onion site on my server, which IPs will connect to it? Will it be just 127.0.0.1 or one of the thousands of daily changing exit nodes? Will they connect over a specific port (8080?) or any other kind of behaviour?

I would like to block all traffic with iptables except a few IPs + Tor Traffic. If all Tor traffic comes over 127.0.0.1 or port 8080 I could just white list/allow 127.0.0.1 or port 8080 right? And then block everything else.

Improve this question

3 Answers 3

Reset to default
1

Will it be just 127.0.0.1 or one of the thousands of daily changing exit nodes?

There are no exit nodes when you connect to a hidden service; you are inside the Tor network, so everyone will have 127.0.0.1 as their IP.

Will they connect over a specific port (8080?) or any other kind of behaviour?

I believe you can configure your hidden service to use the ports you want -you can even choose multiple ports. For more info look here.

Improve this answer
2
  • I think we talk past each other. On my dedicated server with domain asfexample.onion - which IPs are connecting TO my server when users visits asfexample.onion ? Is it 127.0.0.1 or several different IPs (tor nodes) ? are those nodes connecting over a specific port? because i want to block all connections, and only allow the tor connections.
    – Jin Pow
    Commented Aug 16, 2014 at 22:31
  • Your server will connect to the Tor network through its guards. IPs can change, so its best to allow based on the uid of the tor process. In Ubuntu, run "sudo id -u debian-tor" to get the uid (NNN). Then use "-A OUTPUT -m owner --uid-owner NNN -j ACCEPT" to allow. All users will show up as "127.0.0.1" from random ports to whatever port you've specified in HiddenServicePort.
    – mirimir
    Commented Aug 18, 2014 at 2:51
1

You can use netstat to see exactly what IPs are connecting directly. The 127.0.0.1 in your logs is what's seen by applications, rather than the server itself. The server will see your entry guards, though if you set Tor to log very verbosely, you might be able to see the other 3 nodes, up to the rendezvous node. Everything past that (the other 3 nodes) is only known by the client connecting to you (and likewise, the client can only see up to the rendezvous node, not past it).

As for only allowing Tor connections, you can use UFW (Uncomplicated FireWall), an easy to use frontend to iptables. I run an onion site and a Tor middle node on the same server (yeah, I know that's not good for anonymity, but the onion site isn't meant to have it's real IP hidden). I have UFW set to allow ports 9030 and 9001. I'm not sure what it'd be for a hidden service only. Possibly the same.

Improve this answer
1
  • I thought nginx has to be configured to ports 8080 for tor usage? Again. I want to run a .onion site, and with IPtables i want to allow only connections from tor users. Of course i can look at netstat, but if the IPs connecting to my server are the tor nodes than those IPs change every time so how can i just allow tor traffic but block everything else? Are those connections all coming over the same port? (8080, 9001, 9030)? I think this would be sufficient to make a rule with iptables
    – Jin Pow
    Commented Aug 17, 2014 at 11:44
0

All incoming connections will be from the tor instance you used to configure the hidden service. E.g. if you are running a server listening on port 8080, and you have a line like this in your torrc:

HiddenServicePort 80 127.0.0.1:8080

...then all connections will come from localhost, as the tor binary and your server are running on the same machine.

If your tor relay and the hidden service are running on different machines (or different VMs), e.g. tor is running on hostA and the server you want to export as a hidden service is running on hostB, then you would put the following in your torrc:

HiddenServicePort 80 hostB:8080

In this case, all connections would come from hostA, as this is where tor is running.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .