I'm attempting to advise another party on how to block just requests from Tor exit nodes, not non-exit relays. I think I understand the correct data sources to provide to them, but I'd like confirmation that this is the correct approach.
Constraints
- They need the data in bulk, not query-dnsbl-per-request
- They need to check the actual request IP, not the advertised IP of the node
- While this is primarily web traffic, I'm not sure we can assume just ports 80 and 443
- While I'm sure the Tor community would like them to not block Tor exits, I think that's non-negotiable due to their business model. However, getting rid of these false positives is no doubt an improvement for everybody.
Resources
- I've found https://check.torproject.org/cgi-bin/TorBulkExitList.py?ip=8.8.8.8&port=443 which AIUI generates lists of IPs based on advertised exit policies and addresses for a given port (call this the Bulk Exit Query for 443)
- I've found https://check.torproject.org/exit-addresses which appears to list the actual outbound IP addresses of exit nodes, I think based on TorDNSEL data (call this the TorDNSEL List). It's not clear which exit ports this is based on, however!
What surprises me is that the former is not a subset of the latter. I would expect that some exits do not allow 443, so they'd only be on the TorDNSEL List, but anything on the Bulk Exit Query for 443 list should be included on the TorDNSEL List. It's possible that the mismatch there is due to exits that have inbound and outbound traffic on different IPs.
Partial solution
My inclination is to advise the other party to combine the following data sources for their blocklist:
- TorDNSEL List
- Bulk Exit Query for 80, 443, 8080, 8443, and other ports that are relevant to their business, using... what IP?
Remaining questions
- How would one get Bulk Exit query data agnostic of destination IP?
- Does Bulk Exit use advertised or actual addresses? Their docs imply the latter (and mention using TorDNSEL for this), but then why the mismatch?
- Is there anything I'm missing here?