I am new to Tor and currently trying to understand the architecture of onion routing. However, I came across this TorDNSEL which makes it possible (for a tool using TorDNSEL) to detect whether traffic is coming from Tor exit node or not? This way websites can check the source IP against a list of IPs of exit nodes and block the traffic accordingly. I am not entirely sure why Tor publishes the exit node IP addresses publicly. Is it how Tor is designed or is it more of a "courtesy" to the websites/organizations who wants to block Tor traffic?

Any response would be much appreciated.

  • Request looks as follows: you -> tunnel -> exit node inbound ip + port -> exit node outbound ip + port -> website Inbound ip + ports are published because they are so easy to detect. These ip addresses are available in tor control api. Outbound ips are not published. Today we have about 5% of exit nodes where inbound ip != outbound ip. The world with cheap ipv6 address is coming. The count of exit nodes servers where inbound != outbound will increase. Each server will have a bag of possible outbound ipv6 addresses. – puchu Aug 23 '17 at 23:13
  • It's still not going to be advantageous for exit operators to hide the fact that they're an exit, and if some ipv6 range is using different exit addresses its more likely that the entire range would just get blocked by blacklist maintainers if an exit is anywhere in the range, making it more of a burden on exit operators and more difficult to find willing ISPs. Even if it were feasible, it's not a good idea. – cacahuatl Aug 24 '17 at 2:49
  • Also "Outbound ips are not published." they absolutely are, the tor project runs probes through exits periodically and tests which IP address they exit from and it gets added to the list of known exits and distributed through dnsel or bulk-exit-list. – cacahuatl Aug 24 '17 at 2:51
  • ipv4 addresses are expensive so it is possible to detect all possible outbound ip addresses. It is impossible to detect all ipv6 addresses. Banning ipv6 bags is possible today, but it won't be possible tomorrow, when distribution mechanism of ipv6 addresses will be changed. – puchu Aug 24 '17 at 8:14
  • Citation on how ipv6 won't be assigned in contiguous blocks to people? How will routing work if we're all just getting IPs from outside the blocks that our provider is meant to own? – cacahuatl Aug 24 '17 at 9:11

The list of all Tor relays and whether they are exits needs to be public, because Tor clients use this information to build circuits.

There is no point in trying to keep this information 'secret' because anyone could obtain the list by running a client and then publish it.

For operators of exit relays, the fact that they are publicly advertised as such may help them deal with abuse reports and DMCA noticed and the like.

See this related question.

  • Note that there are "hard-coded" tor relay IPs in the code itself. These are considered the most stable/root bridged relays, in the event that someone must use a bridge to connect to Tor. Kind of cool. But, requires you stay up to date on the latest Tor/Torbrowser version to keep your client's ability to connect to hidden bridges if you are very restricted from the net. – eduncan911 Apr 10 '17 at 16:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.