I was reading this article "Nine Questions about Hidden Services". It's an interview with an individual who develops hidden services for Tor.
One of the questions (#4) is "Do you run an onion service yourself?" and part of the developers response to this is:
Also, onion services have a property called NAT-punching; (NAT=Network Address Translation). NAT blocks incoming connections;it builds walls around you. Onion services have NAT punching and can penetrate a firewall. In my university campus, the firewall does not allow incoming connections to my SSH server, but with an onion service the firewall is irrelevant.
So I am interested about the claim that an onion service can penetrate a firewall.
Looking at the developers answer, it seems to me that he is talking about a situation where we have:
- Server A. This one is on an internal network and runs a Tor hidden service.
- Server B. This one runs a firewall that controls access between the internet and Server A.
Based on that the developer says that the firewall is "irrelevant", it seems like regardless of the settings on the firewall, the Tor service can be accessed through the internet. To me this seems ridiculous but maybe I am wrong in something.
The questions I wanted to ask:
- Is it true that the Tor service can bypass a firewall, and if yes, why is that?
- If the Tor service can bypass a firewall, how can that be mitigated?