6 ms·

Expose server behind NAT with Tor

85 points by marcodiego 5y ago

geoffeg 5y ago
Another option is a VPN as a service solution like tailscale. Tailscale does a lot of work to get around NAT and has some great articles on their blog about it. https://tailscale.com/blog/how-nat-traversal-works/ https://tailscale.com/blog/how-nat-traversal-works/
- wjkohnen 5y ago
  Oh I love tailscale, it is so performant and just works (mostly). However, I have used Tor for many years for this use case and still have it around as a fallback for machines that can be hard to reach spatially.
  - wernerb 5y ago
    Wireguard is performant, tailscale makes it convenient
    - nextfx 5y ago
      Is there a way of doing NAT hole-punching with Wireguard?
deleted 5y ago
[deleted]
anderspitman 5y ago
There are essentially 3 ways proxy tunneling like this is done: 1. The Tor method mentioned in this article - Will probably be the worst performance but it's free and offers some privacy features. 2. VPN - WireGuard (Tailscale is popular), OpenVPN, IPsec etc. Best performance, but requires some low-level configuration on both the client and server. You'll probably need admin privileges on the client to configure network interfaces. This is usually automated in practice. If you're on network that blocks UDP, that can also be an issue. You also need a server with a public IP, which generally you'll have to pay for. 3. User-space tunnels - Solutions like SSH remote port forwarding, ngrok, etc. Convenient because on the client you don't need elevated privileges. Performance will likely be somewhere between Tor and VPN. Although note that unless you have very fast internet upload speeds, tunnel performance isn't likely to be your bottleneck. Many solutions multiplex over a single TCP connection, which can cause issues in lossy network conditions due to head-of-line blocking. You need a server with a public IP just like with a VPN. I maintain a list of proxy tunneling solutions here: https://github.com/anderspitman/awesome-tunneling https://github.com/anderspitman/awesome-tunneling
- belter 5y ago
  Nice collection of resources. Thanks for creating it.
superkuh 5y ago
Every single tor .onion URL in this article no longer works in Tor clients. Why? Because the tor project decided to throw away 15 years of communities and interlinking and search indices just to make sure people don't accidentally use tor v2 (which is still more secure than the clear web) and force them to use the far more secure tor v3 (an entirely new network). They did this in Oct/Nov 2021 after a couple years of warning of depreciation (not deletion).
goodpoint 5y ago
The non anonymous / single hop mode makes the onion service faster: https://blog.torproject.org/whats-new-tor-0298/ https://blog.torproject.org/whats-new-tor-0298/
- madacol 5y ago
  Awesome!, thank you, I needed this!
neilalexander 5y ago
The main downside to this is that performance will generally be quite bad. Tor trades performance for anonymity. Unless you specifically need anonymity — which is highly unlikely when you are just trying to reach back to a host of your own behind a NAT — there probably isn't any benefit in using Tor.
- crtasm 5y ago
  I'd still recommend trying it - performance is good enough for my needs. Is there still an onion service config option to use 3 hops instead of 6? I can't find the documentation on the current tor project website. edit: found it in the manpage: HiddenServiceSingleHopMode
  - system33- 5y ago
    Disable the SocksPort, then set two options to really convince tor that you know what you're doing, then configure your onion service as usual. SocksPort 0 HiddenServiceSingleHopMode 1 HiddenServiceNonAnonymousMode 1 HiddenServiceDir /var/lib/tor/ssh_service HiddenServicePort 22 HiddenServiceDir /var/lib/tor/http_service HiddenServicePort 80
    - madacol 5y ago
      why disable SocksPort?
  - zxcvbn4038 5y ago
    By default it is six hops for complete circuit between client and hidden service. Three hops from client to rendezvous point, then three hops from rendezvous point to the hidden service. If you go below that you might as well host on the public internet.
    - ycuser2 5y ago
      If the main goal is not anonymity this should not be a problem?
kevin_nisbet 5y ago
For some reason I'm under the impression that onion services were discoverable, or partially discoverable by relay operators, or some such. IT's been quite awhile though and I think there was some talk of changing that. Does anyone know if that has changed? Last time someone suggested to me, which was several years ago, it didn't seem to have the security properties the person suggesting the approach thought it had, specifically that tor was adding security via the onion service. Anyone have up to date information?
- madars 5y ago
  I think for v2 onions (removed from Tor since this past Fall) HSDir operators could enumerate them, but v3 onions (ones in use now) should be resistant to that. I'm not sure how strongly resistant though.
  - bumblebeast 5y ago
    https://www.hackerfactor.com/blog/index.php?/categories/19-Tor https://www.hackerfactor.com/blog/index.php?/categories/19-T... Still some vulnerability with v3. :(
_wldu 5y ago
If you use Tor, you should stop. I believe that it is mostly used by criminals and that it is largely ran by law enforcement agencies. I cannot prove this but I believe it is true. Simply using it makes you suspect. Also, if you have a need to use Tor for work purposes, get written permission from your senior management and describe exactly what you will do while using Tor (scan our hosts externally, test our firewall rules, find exposed services or mis-configured systems, etc.). If your goal is to be anonymous while surfing the Internet, find some other way, but stop using Tor for that.
- superkuh 5y ago
  Unfortunately the Tor Project agrees with you. They value privacy and security far more than a stable address. The destruction of the entire tor .onion web in Oct/Nov 2021 was pretty much the last straw. The Tor Project only cares about shady people. Anyone wanting to use it for a stable .onion address for their non-private communities should stop using tor.
- ranger_danger 5y ago
  Guns are mostly used by criminals. You should stop. /s
  - karmanyaahm 5y ago
    Criminals drink water. You should stop drinking water right now if you don't want to turn into a criminal! /s
  - nullenvk 5y ago
    Remember, US dollars are used by criminals too. /s
- anon9001 5y ago
  If you don't use tor, you should start. I believe that it is mostly used by oppressed populations and that it is largely ran by parties that get utility from anonymity (activists, spies, law enforcement). I cannot prove this but I believe it is true. Simply using tor increases all of our security. Also, if you have the option to use for work purposes, get your organization to consider contributing to tor. If you find utility in it, consider running additional nodes. If your goal is for anonymity to be possible on the internet, start using tor wherever you can. There, I fixed it for you ;)
throwaway_moon 5y ago
Another benefit is that Tor has built-in load balancing and failover. You can use it with onionbalance.
unstatusthequo 5y ago
How about ngrok? Works great.

85 points by marcodiego 5y ago

Another option is a VPN as a service solution like tailscale. Tailscale does a lot of work to get around NAT and has some great articles on their blog about it. https://tailscale.com/blog/how-nat-traversal-works/ https://tailscale.com/blog/how-nat-traversal-works/

wjkohnen 5y ago
Oh I love tailscale, it is so performant and just works (mostly). However, I have used Tor for many years for this use case and still have it around as a fallback for machines that can be hard to reach spatially.
- wernerb 5y ago
  Wireguard is performant, tailscale makes it convenient
  - nextfx 5y ago
    Is there a way of doing NAT hole-punching with Wireguard?

deleted 5y ago

[deleted]

anderspitman 5y ago

There are essentially 3 ways proxy tunneling like this is done: 1. The Tor method mentioned in this article - Will probably be the worst performance but it's free and offers some privacy features. 2. VPN - WireGuard (Tailscale is popular), OpenVPN, IPsec etc. Best performance, but requires some low-level configuration on both the client and server. You'll probably need admin privileges on the client to configure network interfaces. This is usually automated in practice. If you're on network that blocks UDP, that can also be an issue. You also need a server with a public IP, which generally you'll have to pay for. 3. User-space tunnels - Solutions like SSH remote port forwarding, ngrok, etc. Convenient because on the client you don't need elevated privileges. Performance will likely be somewhere between Tor and VPN. Although note that unless you have very fast internet upload speeds, tunnel performance isn't likely to be your bottleneck. Many solutions multiplex over a single TCP connection, which can cause issues in lossy network conditions due to head-of-line blocking. You need a server with a public IP just like with a VPN. I maintain a list of proxy tunneling solutions here: https://github.com/anderspitman/awesome-tunneling https://github.com/anderspitman/awesome-tunneling

belter 5y ago
Nice collection of resources. Thanks for creating it.

superkuh 5y ago

Every single tor .onion URL in this article no longer works in Tor clients. Why? Because the tor project decided to throw away 15 years of communities and interlinking and search indices just to make sure people don't accidentally use tor v2 (which is still more secure than the clear web) and force them to use the far more secure tor v3 (an entirely new network). They did this in Oct/Nov 2021 after a couple years of warning of depreciation (not deletion).

goodpoint 5y ago

The non anonymous / single hop mode makes the onion service faster: https://blog.torproject.org/whats-new-tor-0298/ https://blog.torproject.org/whats-new-tor-0298/

madacol 5y ago
Awesome!, thank you, I needed this!

neilalexander 5y ago

The main downside to this is that performance will generally be quite bad. Tor trades performance for anonymity. Unless you specifically need anonymity — which is highly unlikely when you are just trying to reach back to a host of your own behind a NAT — there probably isn't any benefit in using Tor.

crtasm 5y ago
I'd still recommend trying it - performance is good enough for my needs. Is there still an onion service config option to use 3 hops instead of 6? I can't find the documentation on the current tor project website. edit: found it in the manpage: HiddenServiceSingleHopMode
- system33- 5y ago
  Disable the SocksPort, then set two options to really convince tor that you know what you're doing, then configure your onion service as usual. SocksPort 0 HiddenServiceSingleHopMode 1 HiddenServiceNonAnonymousMode 1 HiddenServiceDir /var/lib/tor/ssh_service HiddenServicePort 22 HiddenServiceDir /var/lib/tor/http_service HiddenServicePort 80
  - madacol 5y ago
    why disable SocksPort?
- zxcvbn4038 5y ago
  By default it is six hops for complete circuit between client and hidden service. Three hops from client to rendezvous point, then three hops from rendezvous point to the hidden service. If you go below that you might as well host on the public internet.
  - ycuser2 5y ago
    If the main goal is not anonymity this should not be a problem?

kevin_nisbet 5y ago

For some reason I'm under the impression that onion services were discoverable, or partially discoverable by relay operators, or some such. IT's been quite awhile though and I think there was some talk of changing that. Does anyone know if that has changed? Last time someone suggested to me, which was several years ago, it didn't seem to have the security properties the person suggesting the approach thought it had, specifically that tor was adding security via the onion service. Anyone have up to date information?

madars 5y ago
I think for v2 onions (removed from Tor since this past Fall) HSDir operators could enumerate them, but v3 onions (ones in use now) should be resistant to that. I'm not sure how strongly resistant though.
- bumblebeast 5y ago
  https://www.hackerfactor.com/blog/index.php?/categories/19-Tor https://www.hackerfactor.com/blog/index.php?/categories/19-T... Still some vulnerability with v3. :(

_wldu 5y ago

If you use Tor, you should stop. I believe that it is mostly used by criminals and that it is largely ran by law enforcement agencies. I cannot prove this but I believe it is true. Simply using it makes you suspect. Also, if you have a need to use Tor for work purposes, get written permission from your senior management and describe exactly what you will do while using Tor (scan our hosts externally, test our firewall rules, find exposed services or mis-configured systems, etc.). If your goal is to be anonymous while surfing the Internet, find some other way, but stop using Tor for that.

superkuh 5y ago
Unfortunately the Tor Project agrees with you. They value privacy and security far more than a stable address. The destruction of the entire tor .onion web in Oct/Nov 2021 was pretty much the last straw. The Tor Project only cares about shady people. Anyone wanting to use it for a stable .onion address for their non-private communities should stop using tor.
ranger_danger 5y ago
Guns are mostly used by criminals. You should stop. /s
- karmanyaahm 5y ago
  Criminals drink water. You should stop drinking water right now if you don't want to turn into a criminal! /s
- nullenvk 5y ago
  Remember, US dollars are used by criminals too. /s
anon9001 5y ago
If you don't use tor, you should start. I believe that it is mostly used by oppressed populations and that it is largely ran by parties that get utility from anonymity (activists, spies, law enforcement). I cannot prove this but I believe it is true. Simply using tor increases all of our security. Also, if you have the option to use for work purposes, get your organization to consider contributing to tor. If you find utility in it, consider running additional nodes. If your goal is for anonymity to be possible on the internet, start using tor wherever you can. There, I fixed it for you ;)

throwaway_moon 5y ago

Another benefit is that Tor has built-in load balancing and failover. You can use it with onionbalance.

unstatusthequo 5y ago

How about ngrok? Works great.