How would I block exit nodes correctly?

Question

I'm attempting to advise another party on how to block just requests from Tor exit nodes, not non-exit relays. I think I understand the correct data sources to provide to them, but I'd like confirmation that this is the correct approach.

Constraints

• They need the data in bulk, not query-dnsbl-per-request
• They need to check the actual request IP, not the advertised IP of the node
• While this is primarily web traffic, I'm not sure we can assume just ports 80 and 443
• While I'm sure the Tor community would like them to not block Tor exits, I think that's non-negotiable due to their business model. However, getting rid of these false positives is no doubt an improvement for everybody.

Resources

• I've found https://check.torproject.org/cgi-bin/TorBulkExitList.py?ip=8.8.8.8&port=443 which AIUI generates lists of IPs based on advertised exit policies and addresses for a given port (call this the Bulk Exit Query for 443)
• I've found https://check.torproject.org/exit-addresses which appears to list the actual outbound IP addresses of exit nodes, I think based on TorDNSEL data (call this the TorDNSEL List). It's not clear which exit ports this is based on, however!

What surprises me is that the former is not a subset of the latter. I would expect that some exits do not allow 443, so they'd only be on the TorDNSEL List, but anything on the Bulk Exit Query for 443 list should be included on the TorDNSEL List. It's possible that the mismatch there is due to exits that have inbound and outbound traffic on different IPs.

Partial solution

My inclination is to advise the other party to combine the following data sources for their blocklist:

• TorDNSEL List
• Bulk Exit Query for 80, 443, 8080, 8443, and other ports that are relevant to their business, using... what IP?

Remaining questions

• How would one get Bulk Exit query data agnostic of destination IP?
• Does Bulk Exit use advertised or actual addresses? Their docs imply the latter (and mention using TorDNSEL for this), but then why the mismatch?
• Is there anything I'm missing here?

Answer 1

You could run TorDNSEL and cache the DNS information locally. That will allow you to only have to check once. Another thing is that you could simply download the consensus form any directory mirror. This will give you precise information that you can build a lookup table upon.

There also is Onionoo. You could create a cron job or something in your application that does regularly fetch a list of Tor Exit nodes and then populate an in-memory lookup table.

https://onionoo.torproject.org/

To get a list of exits you can use: curl "https://onionoo.torproject.org/summary?flag=exit". From that you can sort out which ones are running and then you have a concise, up to date list.