The answer here states that in case of blocking all the Authority servers new clients would be sad.
I conducted an experiment, where I blocked all the Authority servers and a new, never used before client still bootstrapped and established a Tor circuit. Although it took 30 minutes to do so.
So I'd like to know if Tor has fallback directory servers? Or somehow it must get the first IP to connect to if all the Authority servers are blocked. And where does that IP come from?
Look at the answer one more time carefully: Would distributed denial of service (DDoS) attacks on the directory authorities disrupt the Tor network?
The paragraph 3. state that (The emphasis is mine):
- The bad guy manages to shut down all 9 directory authorities. This has the additional negative effect of new clients not being able to download their initial consensus during the bootstrap process, so they would be sad immediately. We may have a new design in place that ships a list of fallback directory mirrors with the sources which would soften the blow here.
Some relays are assigned as mirror directory authorities, in addition to their other roles. They will handle the case as a back-up if all directory authorities are blocked, and do not allow a total censorship of Tor network for new users and others.
You may look at this Web site: http://torstatus.blutmagie.de/
Servers have different properties listed after their name. For example: Fast server, Exit server, Directory server, etc. If you carefully look at properties of servers, you will notice that a lot of them have a folder type icon in front of them, indicating they are Directory server, this means they are mirrors of dirctory servers. For additional insight you may start a Wireshark packet analyzer software before starting Tor browser and observe what IP addresses your system connect to during the the time that it should obtain consensus from dirctory servers. It will connect to some directory servers and some mirrors of dirctory servers.
It seems that Tor does not have a fallback. Although following paragraph can be found under Tor ChangeLog:
o Major features (client resilience):
- Add a new "FallbackDir" torrc option to use when we can't use
a directory mirror from the consensus (either because we lack a
consensus, or because they're all down). Currently, all authorities
are fallbacks by default, and there are no other default fallbacks,
but that will change. This option will allow us to give clients a
longer list of servers to try to get a consensus from when first
connecting to the Tor network, and thereby reduce load on the
directory authorities.
In reality it has not been implemented and only the optional command line option * FallbackDir address:port orport=port id=fingerprint [weight=num] can be used.
I also made a fatal mistake by looking only at the public Tor Authority list Atlas and Torstatus . In reality one of the Authority server IP has changed and could be found only from source code, 128.31.0.34 -> 128.31.0.39.
After adding that IP also to iptables Tor could not establish a circuit and bootstrap. So to conclude Tor does not have a fallback, at least to this date.