6

I faced a problem when Tor, which used to work for ages at campus of my friend (he updated it regularly), just stopped working one day. I did the following:

  1. Downloaded latest Tor at home. Configured it to use ports 80, 443 and default obfs4 bridges.
  2. Started the browser at home and ensured that it was working
  3. Copied tor browser folder to flash drive
  4. Brought it to my friend's campus (tons of sites are blocked there)
  5. Copied the folder from flash to his PC
  6. Started the Tor as usual. It used the settings which worked fine at home. But this time it wasn't able to connect. After waiting for several minutes and seeing the warning icon in status window I hit configuration button and again configured Tor to use obfs4 bridges. It again wasn't able to connect.

Below is the log:

7/10/2015 15:24:38 PM.129 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections. 
7/10/2015 15:24:38 PM.129 [NOTICE] Opening Socks listener on 127.0.0.1:9150 
7/10/2015 15:24:46 PM.198 [NOTICE] Bridge at '104.131.108.182:56880' isn't reachable by our firewall policy. Asking bridge authority instead. 
7/10/2015 15:24:46 PM.198 [NOTICE] While fetching directory info, no running dirservers known. Will try again later. (purpose 6) 
7/10/2015 15:24:46 PM.198 [NOTICE] Bridge at '83.212.101.3:41213' isn't reachable by our firewall policy. Asking bridge authority instead. 
7/10/2015 15:24:46 PM.198 [NOTICE] While fetching directory info, no running dirservers known. Will try again later. (purpose 6) 
7/10/2015 15:24:46 PM.198 [NOTICE] Bootstrapped 5%: Connecting to directory server 
7/10/2015 15:24:46 PM.200 [NOTICE] Bootstrapped 10%: Finishing handshake with directory server 
7/10/2015 15:24:46 PM.237 [WARN] Proxy Client: unable to connect to 178.209.52.110:443 ("general SOCKS server failure") 
7/10/2015 15:24:46 PM.237 [NOTICE] Ignoring directory request, since no bridge nodes are available yet. 
7/10/2015 15:24:47 PM.179 [NOTICE] Delaying directory fetches: No running bridges 
7/10/2015 15:26:58 PM.900 [NOTICE] Closing no-longer-configured Socks listener on 127.0.0.1:9150 
7/10/2015 15:26:58 PM.900 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections. 
7/10/2015 15:26:58 PM.900 [NOTICE] Closing old Socks listener on 127.0.0.1:9150 
7/10/2015 15:27:42 PM.657 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections. 
7/10/2015 15:27:42 PM.657 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections. 
7/10/2015 15:27:42 PM.657 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections. 
7/10/2015 15:27:42 PM.657 [NOTICE] Opening Socks listener on 127.0.0.1:9150 
7/10/2015 15:27:49 PM.288 [WARN] Proxy Client: unable to connect to 178.209.52.110:443 ("general SOCKS server failure") 
7/10/2015 15:28:10 PM.243 [WARN] Proxy Client: unable to connect to 104.131.108.182:56880 ("general SOCKS server failure") 
7/10/2015 15:28:10 PM.244 [WARN] Proxy Client: unable to connect to 83.212.101.3:41213 ("general SOCKS server failure") 
7/10/2015 15:28:10 PM.244 [NOTICE] Ignoring directory request, since no bridge nodes are available yet. 
7/10/2015 15:28:11 PM.151 [NOTICE] Delaying directory fetches: No running bridges 
7/10/2015 15:30:59 PM.312 [NOTICE] Closing no-longer-configured Socks listener on 127.0.0.1:9150 
7/10/2015 15:30:59 PM.312 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections. 
7/10/2015 15:30:59 PM.312 [NOTICE] Closing old Socks listener on 127.0.0.1:9150

I don't get it. Why DisableNetwork gets set if I did nothing with Tor at home?

Moreover, I have tried:

  1. Repeated all of the steps above but downloaded Tor 5.0 (alpha)
  2. Used obfs3 bridges - same errors.
  3. Used custom bridges for obfs4 transport (got them from bridges@torproject email) - same errors
  4. MOST FUNNY THING - for each of the servers from the log I am able to do a tenet on the specified port successfully.

UPDATE.

Tried meek-google as suggested in answer, but it fails (I made 2 attempts). Google is available but GMail is not. Honestly I got much the same message when I use ANY transport except obfs3(4) - fte, flashproxy etc. Just the host changes.

7/24/2015 19:19:26 PM.500 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections. 
7/24/2015 19:19:26 PM.500 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections. 
7/24/2015 19:19:26 PM.500 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections. 
7/24/2015 19:19:26 PM.500 [NOTICE] Opening Socks listener on 127.0.0.1:9150 
7/24/2015 19:19:31 PM.300 [NOTICE] Bootstrapped 5%: Connecting to directory server 
7/24/2015 19:19:31 PM.400 [NOTICE] Bootstrapped 10%: Finishing handshake with directory server 
7/24/2015 19:19:31 PM.800 [WARN] Problem bootstrapping. Stuck at 10%: Finishing handshake with directory server. (DONE; DONE; count 1; recommendation warn; host 46D4A71197B8FA515A826C6B017C522FE264655B at 0.0.2.0:1) 
7/24/2015 19:19:31 PM.800 [WARN] 1 connections have failed: 
7/24/2015 19:19:31 PM.800 [WARN]  1 connections died in state handshaking (TLS) with SSL state SSLv2/v3 read server hello A in HANDSHAKE 
7/24/2015 19:19:55 PM.400 [WARN] Problem bootstrapping. Stuck at 10%: Finishing handshake with directory server. (DONE; DONE; count 2; recommendation warn; host 46D4A71197B8FA515A826C6B017C522FE264655B at 0.0.2.0:1) 
7/24/2015 19:19:55 PM.400 [WARN] 2 connections have failed: 
7/24/2015 19:19:55 PM.400 [WARN]  2 connections died in state handshaking (TLS) with SSL state SSLv2/v3 read server hello A in HANDSHAKE
Improve this question
9
  • Does your friend use a firewall? If yes, can you allow the ports for the obfs4 bridge?
    – Jens Kubieziel
    Commented Jul 10, 2015 at 19:14
  • Yes, I believe. Which ports needs to be allowed? Though I configured at home ports 80,443 to be used and they are not blocked for sure.
    – Maksim Khaitovich
    Commented Jul 10, 2015 at 19:25
  • BTW, how to configure the ports usage from tor network settings? I found a button for port configuration only when you successfully run a Tor Browser/
    – Maksim Khaitovich
    Commented Jul 10, 2015 at 19:26
  • @JensKubieziel so any thoughts on that?
    – Maksim Khaitovich
    Commented Jul 13, 2015 at 19:10
  • Can you remove the configuration for ports 80 and 443 and restart Tor? Does Tor start in this case? Do you see other messages in the log?
    – Jens Kubieziel
    Commented Jul 21, 2015 at 22:16

1 Answer 1

Reset to default
3
+100

Obfs3 and Obfs4 have a goal of obscuring traffic so that it looks like arbitrary random data. Some environments have created policies such that if the protocol identified via deep packet inspection is unknown, block it. By design, obfs3/4 will never be fingerprinted as an existing protocol and therefore blocked these environments.

When you attempted to telnet into the bridges, this is a cleartext communication that would have been allowed by such a firewall rule, but blocked if you attempted to send it random, unstructured data.

Meek on the other hand attempts to hide traffic inside of existing communications to an HTTPS endpoint. The TBB comes with some builtin Meek endpoints that you can try. The only way that the university could block these communications would be to block access to Google and the other supported services.

Hoping that works.

Improve this answer
2
  • 2
    Thanks for info, but meek also fails (I am sure that amazon and azure are blocked but google itself is available - except gmail). When I do meek I get a error which you could see in the updated question
    – Maksim Khaitovich
    Commented Jul 24, 2015 at 16:20
  • And actually I get same error when I use any other transport except obfs
    – Maksim Khaitovich
    Commented Jul 24, 2015 at 16:36

Not the answer you're looking for? Browse other questions tagged .