3

I was reading this article "Nine Questions about Hidden Services". It's an interview with an individual who develops hidden services for Tor.

One of the questions (#4) is "Do you run an onion service yourself?" and part of the developers response to this is:

Also, onion services have a property called NAT-punching; (NAT=Network Address Translation). NAT blocks incoming connections;it builds walls around you. Onion services have NAT punching and can penetrate a firewall. In my university campus, the firewall does not allow incoming connections to my SSH server, but with an onion service the firewall is irrelevant.

So I am interested about the claim that an onion service can penetrate a firewall.

Looking at the developers answer, it seems to me that he is talking about a situation where we have:

  1. Server A. This one is on an internal network and runs a Tor hidden service.
  2. Server B. This one runs a firewall that controls access between the internet and Server A.

Based on that the developer says that the firewall is "irrelevant", it seems like regardless of the settings on the firewall, the Tor service can be accessed through the internet. To me this seems ridiculous but maybe I am wrong in something.

The questions I wanted to ask:

  1. Is it true that the Tor service can bypass a firewall, and if yes, why is that?
  2. If the Tor service can bypass a firewall, how can that be mitigated?
Improve this question
1

1 Answer 1

Reset to default
3

When a normal, non-hidden service is behind a NAT router / firewall, it can not accept incoming connections from the internet, unless some port forwarding is configured in the router.

Hidden services get around this problem because nobody needs to connect from outside the firewall to inside the firewall.

When a client connects to a hidden service, both parties use an outbound connection to a rendez-vous point inside the Tor network. (Edit: not directly. It's Tor connection through a guard etc..)

All that is needed is that both are able to make outbound connections to the Tor network. So NAT is not a factor anymore. The firewall doesn't see any connections from outside to the (web?)-server inside.

Improve this answer
6
  • 1
    "All that is needed is that both are able to make outbound connections to the Tor network" - and to get Tor working in the first place, you've had to allow it through your firewall.
    – Richard Horrocks
    Commented Nov 20, 2015 at 17:19
  • Right. Your Tor client must be allowed to connect out to a Tor guard. But in order to host a HS, you don't need to be a relay, and you don't need to be reachable from the internet. So yeah, the firewall is not totally irrelevant if it acts on outbound connections too, but NAT has been 'punched'.
    – Jobiwan
    Commented Nov 20, 2015 at 17:25
  • @RichardHorrocks, that is an excellent point, although now I am wondering if there are any difficulties in actually blocking Tor HS from passing through the firewall (e.g. random port numbers used by hidden services, etc.)?
    – user9964
    Commented Nov 20, 2015 at 17:26
  • 1
    @coderworks The port numbers used by HSs are irrelevant. The port that the HS listens on is virtual. It is only used to know which hidden service to connect to. The port number that the actual service listens on only needs to be reachable form the Tor that hosts the HS, which is inside the same network or even on the same machine.
    – Jobiwan
    Commented Nov 20, 2015 at 17:55
  • 1
    @coderworks "to what degree is this true?" The web server needs onlt be reachable from the Tor that hosts the HS. Tor only needs to be able to connect outbound. Nothing on the inside needs to be reachable from the outside. Everything goes through Tor connections initiated from the Tor inside the network to the guard outside the network.
    – Jobiwan
    Commented Nov 20, 2015 at 17:59

You must log in to answer this question.