Is there a way to resolve Dynamic DNS with Tor so that I can connect to my computer who is behind a NAT ? Do I have to enable the "no-ip" service on my router or do I have to make a port forward ?
3 Answers
You can run a hidden service on your computer or any computer inside your local network. You can then add HiddenServicePort directives for all the ports you want reachable.
This way you go around NAT because both your HS and your client connect out to the Tor network and neither need to be reachable.
You don't need to do anything special to your router.
See here for how to setup a hidden service.
See here for some extra security: How to use Hidden Service Authentication?
Is there a way to resolve Dynamic DNS with Tor[?]
No, not in the sense I am pretty sure you mean.
Is there a way to [connect to a] Dynamic DNS [address] with Tor so that I can connect to my computer [which] is behind a NAT ?
If you have a public-facing, internet accessible server available via Dynamic DNS (e.g. somedomain.noip.com), you can connect to this via TOR like any regular website.
Setup your web site to work on the "normal" internet via Dynamic DNS, then use the TOR browser (or however you are using TOR) to access that website (e.g. by typing "somedomain.noip.com" into the TOR browser bar).
The other option, as mentioned by @Jobiwan, is to set the site up as a hidden service (a TOR-only accessible website). If you do this, your site will only be available on the TOR network (i.e. via the TOR browser) and not the "normal" internet. However, if you set up a hidden service, you do not need Dynamic DNS. Your web site will have a TOR .onion address like zxcvbnnfdsfgsskj5.onion.
The Third Option
You can always set up your web server to respond to both "normal" internet queries (via Dynamic DNS) and hidden service queries (e.g. zxcvbnnfdsfgsskj5.onion) by using virtual hosts or the like and pointing each virtual host to the same document root on your web server (the same folder where your website is stored).
You can't forward ports over Tor. The reason is when you are creating a circuit, you choose an exit node that matches a specific policy such as allowing HTTP and HTTPS outbound. You do not "open" a port to allow something to remotely access your system. This will never work and it's by design. The only option would be to use a NAT traversal technology such as STUN but this throws out your attempts to be anonymous.