9

I am new to Tor and currently trying to understand the architecture of onion routing. However, I came across this TorDNSEL which makes it possible (for a tool using TorDNSEL) to detect whether traffic is coming from Tor exit node or not? This way websites can check the source IP against a list of IPs of exit nodes and block the traffic accordingly. I am not entirely sure why Tor publishes the exit node IP addresses publicly. Is it how Tor is designed or is it more of a "courtesy" to the websites/organizations who wants to block Tor traffic?

Any response would be much appreciated.

8
  • Request looks as follows: you -> tunnel -> exit node inbound ip + port -> exit node outbound ip + port -> website Inbound ip + ports are published because they are so easy to detect. These ip addresses are available in tor control api. Outbound ips are not published. Today we have about 5% of exit nodes where inbound ip != outbound ip. The world with cheap ipv6 address is coming. The count of exit nodes servers where inbound != outbound will increase. Each server will have a bag of possible outbound ipv6 addresses.
    – puchu
    Aug 23, 2017 at 23:13
  • It's still not going to be advantageous for exit operators to hide the fact that they're an exit, and if some ipv6 range is using different exit addresses its more likely that the entire range would just get blocked by blacklist maintainers if an exit is anywhere in the range, making it more of a burden on exit operators and more difficult to find willing ISPs. Even if it were feasible, it's not a good idea.
    – cacahuatl
    Aug 24, 2017 at 2:49
  • Also "Outbound ips are not published." they absolutely are, the tor project runs probes through exits periodically and tests which IP address they exit from and it gets added to the list of known exits and distributed through dnsel or bulk-exit-list.
    – cacahuatl
    Aug 24, 2017 at 2:51
  • ipv4 addresses are expensive so it is possible to detect all possible outbound ip addresses. It is impossible to detect all ipv6 addresses. Banning ipv6 bags is possible today, but it won't be possible tomorrow, when distribution mechanism of ipv6 addresses will be changed.
    – puchu
    Aug 24, 2017 at 8:14
  • Citation on how ipv6 won't be assigned in contiguous blocks to people? How will routing work if we're all just getting IPs from outside the blocks that our provider is meant to own?
    – cacahuatl
    Aug 24, 2017 at 9:11

2 Answers 2

5

The list of all Tor relays and whether they are exits needs to be public, because Tor clients use this information to build circuits.

There is no point in trying to keep this information 'secret' because anyone could obtain the list by running a client and then publish it.

For operators of exit relays, the fact that they are publicly advertised as such may help them deal with abuse reports and DMCA noticed and the like.

See this related question.

1
  • Note that there are "hard-coded" tor relay IPs in the code itself. These are considered the most stable/root bridged relays, in the event that someone must use a bridge to connect to Tor. Kind of cool. But, requires you stay up to date on the latest Tor/Torbrowser version to keep your client's ability to connect to hidden bridges if you are very restricted from the net.
    – eduncan911
    Apr 10, 2017 at 16:55
0

The workaround to this is to deploy and use a private Tor network. Anyone can run their own directory authorities that aren't part of the public network as their own independent Tor network. Therefore, the mere fact that a machine isn't part of the public Tor network doesn't mean it's not a Tor node, strictly speaking.

Tor publishes TorDNSEL as a convenience to prevent the alternative: the need to probe every IP for "signs" of being an exit node (which notably port-scanning , etc. is illegal in certain countries like the United States because collection of such information can be considered conspiracy to commit unauthorized access to a computer) and thus potentially blocking either large ranges of IPs while still being somewhat ineffective, or else only being able to block a small percentage of exit nodes given the vast surface area of the entire public Tor network.

The problem here is that we don't know how many non-public Tor networks there really are out there deployed on the scale of an large intranet. Should these networks at any time decide to disclose their existence to the public, it will have the effect of turning large segments of the internet into de facto Tor nodes, though not necessarily all Public nodes. This in turn would do away with the common misconceived idea that an IP address can be used to identify a person to any degree, as it will become impossible to determine conclusively whether a IP is a Tor node within a private network.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .