Re: [tor-relays] Protecting the bridge port from active probes

2019-03-30 Thread Roger Dingledine
On Sat, Mar 30, 2019 at 08:44:45PM +, Alexander Nasonov wrote: > This works for me: > > AssumeReachable 1 > PublishServerDescriptor 0 > ORPort PUBLIC-IP:2345 NoListen > ORPort 127.0.0.1:2345 NoAdvertise > ExtORPort 127.0.0.1:3456 # you can try auto > ServerTransportListenAddr obfs4

Re: [tor-relays] Protecting the bridge port from active probes

2019-03-30 Thread Alexander Nasonov
Dmitrii Tcvetkov wrote: > On Thu, 28 Mar 2019 17:08:38 + > Marek Szuba wrote: > > > Anyway, here is my logic. In order to operate properly, my bridge must > > have its ORPort reachable from the Internet. > > I might be wrong, but I got impression that if bridge is using > pluggable

Re: [tor-relays] Protecting the bridge port from active probes

2019-03-29 Thread Marek Szuba
On 2019-03-29 07:46, Roger Dingledine wrote: > Yes, this advice is correct. Feel free to firewall off your ORPort > from the outside. > > It will make your bridge complain that it is unreachable, until > somebody reaches it via one of the pluggable transports, which will > satisfy it and it

Re: [tor-relays] Protecting the bridge port from active probes

2019-03-29 Thread Roger Dingledine
On Thu, Mar 28, 2019 at 08:43:34PM +0300, Dmitrii Tcvetkov wrote: > Since your bridge is private then bridge authority is none of your > concerns. In that case you need ORPort reachable only if you have > bridge clients which use bridge without pluggable transports. Yes, this advice is correct.

Re: [tor-relays] Protecting the bridge port from active probes

2019-03-28 Thread Dmitrii Tcvetkov
On Thu, 28 Mar 2019 17:08:38 + Marek Szuba wrote: > Anyway, here is my logic. In order to operate properly, my bridge must > have its ORPort reachable from the Internet. I might be wrong, but I got impression that if bridge is using pluggable transports (obfs3, obfs4, meek, snowflake, etc)

[tor-relays] Protecting the bridge port from active probes

2019-03-28 Thread Marek Szuba
Hello, I run a private obfuscated Tor bridge for myself and some friends. All in all it has worked fine so far but having recently run some security scans on the bridge host, I now wonder how resistant to active probing my bridge is. Apologies if this has already been asked, I have yet to find a