5

I'm attempting to advise another party on how to block just requests from Tor exit nodes, not non-exit relays. I think I understand the correct data sources to provide to them, but I'd like confirmation that this is the correct approach.

Constraints

  • They need the data in bulk, not query-dnsbl-per-request
  • They need to check the actual request IP, not the advertised IP of the node
  • While this is primarily web traffic, I'm not sure we can assume just ports 80 and 443
  • While I'm sure the Tor community would like them to not block Tor exits, I think that's non-negotiable due to their business model. However, getting rid of these false positives is no doubt an improvement for everybody.

Resources

What surprises me is that the former is not a subset of the latter. I would expect that some exits do not allow 443, so they'd only be on the TorDNSEL List, but anything on the Bulk Exit Query for 443 list should be included on the TorDNSEL List. It's possible that the mismatch there is due to exits that have inbound and outbound traffic on different IPs.

Partial solution

My inclination is to advise the other party to combine the following data sources for their blocklist:

  • TorDNSEL List
  • Bulk Exit Query for 80, 443, 8080, 8443, and other ports that are relevant to their business, using... what IP?

Remaining questions

  • How would one get Bulk Exit query data agnostic of destination IP?
  • Does Bulk Exit use advertised or actual addresses? Their docs imply the latter (and mention using TorDNSEL for this), but then why the mismatch?
  • Is there anything I'm missing here?
  • 1
    Is there a reason to not use TorDNSEL directly? This would be the least amount of work and the most accurate as it's a "live" query... – meejah Dec 13 '15 at 20:23
  • You mean querying DNS for every IP? This would be for a high-volume, low-latency application that wouldn't want to spend precious milliseconds on each request talking to a DNS server for every request. – treat your mods well Dec 14 '15 at 22:04
1

You could run TorDNSEL and cache the DNS information locally. That will allow you to only have to check once. Another thing is that you could simply download the consensus form any directory mirror. This will give you precise information that you can build a lookup table upon.

There also is Onionoo. You could create a cron job or something in your application that does regularly fetch a list of Tor Exit nodes and then populate an in-memory lookup table.

https://onionoo.torproject.org/

To get a list of exits you can use: curl "https://onionoo.torproject.org/summary?flag=exit". From that you can sort out which ones are running and then you have a concise, up to date list.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.