I noticed that when using iptables_torify to force connections through TOR that .onion addresses are mapped to local virtual IPs in the 10.66.x.x range. This is indicated in the torrc file:
VirtualAddrNetwork 10.66.0.0/255.255.0.0 AutomapHostsOnResolve 1
Unfortunately, TOR is constantly assigning different IPs to the same hidden service which is causing a few problems. For example:
Whenever I use my local ssh client to connect to a hidden service I get some kind of message like:
The authenticity of host 'blahblahblahblah.onion (10.66.51.17)' can't be established. ECDSA key fingerprint is 0a:1b:2c:..... Are you sure you want to continue connecting (yes/no)?
Now if I click yes all is good until next time I reboot the computer I get the same message again with a different address (eg: 10.66.172.189). Sometimes I get an address that was already used for a different hidden service and I have to go to ~/.ssh/know_keys to delete the line in question before I can connect.
I really need to be able to just tell tor to permanently map address blahblahblah.onion to let's say 10.66.10.10. That way I could just ssh 10.66.10.10 and have the ssh fingerprint for 10.66.10.10 listed once and for all in my ~/.ssh/knownhosts file.
Thank you Linostar for suggesting:
ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no user@host
However SSH is only one of my problems that I showed for illustration purposes. And actually I would like to use the .ssh/known_keys file to verify the keys of the servers I'm connecting to rather than just blindly connecting to the server.
I also need to use other programs that may only give the option of specifying an IP address for outgoing connections. For example, if I want to tell FireFox to connect to a proxy server (the proxy server has a .onion address). I'm sure there's a work around for that too but just specifying the ip address would be a lot simpler for me.
Anyway, I don't want to rely on iptables to send DNS requests to TOR when it would be a lot simpler and more secure to just specify the ip address of the hidden service. On some servers I'm unable to configure iptables anyway. And I don't want to take the risk of a DNS leak in case I made an error configuring iptables or if the configuration was changed without my knowledge.
All that to say that mapping an .onion address to a specific IP would be a very important benefit that would save a lot of trouble for nothing. Hopefully somebody has a solution!