Your TeaInside relay is failing to relay exit traffic

Your TeaInside relay is failing to relay exit traffic

[Georg Koppen]

[-- Attachment #1.1: Type: text/plain, Size: 499 bytes --]

Hello!

Your TeaInside relay[1] seems to fail relaying exit traffic
according to our measurements. We ran some tests and it was not possible
in 5/5 cases to reach e.g. https://torproject.org. Could you please look
into that and resolve the issue on your end?

Please let us know if you have further questions and when the problem is
resolved on your side.

Thanks for running relays!
Georg

[1] 
https://metrics.torproject.org/rs.html#details/F241330F16AF6BD90226CC9130DA8E20B58AAC3B

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: Your TeaInside relay is failing to relay exit traffic

[Ammar Faizi]

[-- Attachment #1.1.1: Type: text/plain, Size: 769 bytes --]

On 8/25/22 1:58 PM, Georg Koppen wrote:
> Hello!
> 
> Your TeaInside relay[1] seems to fail relaying exit traffic
> according to our measurements. We ran some tests and it was not possible
> in 5/5 cases to reach e.g. https://torproject.org. Could you please look
> into that and resolve the issue on your end?
> 
> Please let us know if you have further questions and when the problem is
> resolved on your side.
> 
> Thanks for running relays!
> Georg
> 
> [1] https://metrics.torproject.org/rs.html#details/F241330F16AF6BD90226CC9130DA8E20B58AAC3B

Hi Georg,

Thanks for reporting this issue.

I will take a look into it. But before that, I have a question. How do I
test my exit relay to see whether it's working properly?

-- 
Ammar Faizi

[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 1795 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 495 bytes --]

Re: Your TeaInside relay is failing to relay exit traffic

[Louvian Lyndal]

[-- Attachment #1: Type: text/plain, Size: 1023 bytes --]

On Thu, Aug 25, 2022 at 2:18 PM Ammar Faizi wrote:
> On 8/25/22 1:58 PM, Georg Koppen wrote:
> > Hello!
> >
> > Your TeaInside relay[1] seems to fail relaying exit traffic
> > according to our measurements. We ran some tests and it was not possible
> > in 5/5 cases to reach e.g. https://torproject.org. Could you please look
> > into that and resolve the issue on your end?
> >
> > Please let us know if you have further questions and when the problem is
> > resolved on your side.
> >
> > Thanks for running relays!
> > Georg
> >
> > [1] https://metrics.torproject.org/rs.html#details/F241330F16AF6BD90226CC9130DA8E20B58AAC3B
>
> Hi Georg,
>
> Thanks for reporting this issue.
>
> I will take a look into it. But before that, I have a question. How do I
> test my exit relay to see whether it's working properly?

I checked it, there are many TLS error here:

   TLS error PR_CONNECT_RESET_ERROR while writing with [scrubbed]: TCP
connection reset by peer

I don't understand the reason behind this. Will investigate it.

[-- Attachment #2: tor.log --]
[-- Type: text/x-log, Size: 4401 bytes --]

Aug 25 14:21:21.000 [notice] TLS error PR_CONNECT_RESET_ERROR while writing with [scrubbed]: TCP connection reset by peer
Aug 25 14:21:32.000 [notice] TLS error PR_CONNECT_RESET_ERROR while writing with [scrubbed]: TCP connection reset by peer
Aug 25 14:22:03.000 [notice] TLS error PR_CONNECT_RESET_ERROR while writing with [scrubbed]: TCP connection reset by peer
Aug 25 14:22:03.000 [notice] TLS error PR_CONNECT_RESET_ERROR while writing with [scrubbed]: TCP connection reset by peer
Aug 25 14:22:17.000 [notice] TLS error PR_CONNECT_RESET_ERROR while writing with [scrubbed]: TCP connection reset by peer
Aug 25 14:22:17.000 [notice] TLS error PR_CONNECT_RESET_ERROR while writing with [scrubbed]: TCP connection reset by peer
Aug 25 14:22:17.000 [notice] TLS error PR_CONNECT_RESET_ERROR while writing with [scrubbed]: TCP connection reset by peer
Aug 25 14:22:36.000 [notice] TLS error PR_CONNECT_RESET_ERROR while writing with [scrubbed]: TCP connection reset by peer
Aug 25 14:22:50.000 [notice] TLS error PR_CONNECT_RESET_ERROR while writing with [scrubbed]: TCP connection reset by peer
Aug 25 14:22:58.000 [notice] TLS error PR_CONNECT_RESET_ERROR while writing with [scrubbed]: TCP connection reset by peer
Aug 25 14:23:29.000 [notice] TLS error PR_CONNECT_RESET_ERROR while writing with [scrubbed]: TCP connection reset by peer
Aug 25 14:23:29.000 [notice] TLS error PR_CONNECT_RESET_ERROR while writing with [scrubbed]: TCP connection reset by peer
Aug 25 14:23:41.000 [notice] TLS error PR_CONNECT_RESET_ERROR while writing with [scrubbed]: TCP connection reset by peer
Aug 25 14:23:58.000 [notice] TLS error PR_CONNECT_RESET_ERROR while writing with [scrubbed]: TCP connection reset by peer
Aug 25 14:24:11.000 [notice] TLS error PR_CONNECT_RESET_ERROR while writing with [scrubbed]: TCP connection reset by peer
Aug 25 14:25:19.000 [notice] TLS error PR_CONNECT_RESET_ERROR while reading with [scrubbed]: TCP connection reset by peer
Aug 25 14:25:47.000 [notice] New control connection opened from 127.0.0.1.
Aug 25 14:26:12.000 [notice] New control connection opened from 127.0.0.1.
Aug 25 14:26:37.000 [notice] TLS error PR_CONNECT_RESET_ERROR while writing with [scrubbed]: TCP connection reset by peer
Aug 25 14:26:49.000 [notice] TLS error PR_CONNECT_RESET_ERROR while writing with [scrubbed]: TCP connection reset by peer
Aug 25 14:27:05.000 [notice] TLS error PR_CONNECT_RESET_ERROR while writing with [scrubbed]: TCP connection reset by peer
Aug 25 14:27:20.000 [notice] TLS error PR_CONNECT_RESET_ERROR while writing with [scrubbed]: TCP connection reset by peer
Aug 25 14:27:20.000 [notice] TLS error PR_CONNECT_RESET_ERROR while writing with [scrubbed]: TCP connection reset by peer
Aug 25 14:27:20.000 [notice] TLS error PR_CONNECT_RESET_ERROR while writing with [scrubbed]: TCP connection reset by peer
Aug 25 14:27:20.000 [notice] TLS error PR_CONNECT_RESET_ERROR while writing with [scrubbed]: TCP connection reset by peer
Aug 25 14:27:20.000 [notice] TLS error PR_CONNECT_RESET_ERROR while writing with [scrubbed]: TCP connection reset by peer
Aug 25 14:27:20.000 [notice] TLS error PR_CONNECT_RESET_ERROR while writing with [scrubbed]: TCP connection reset by peer
Aug 25 14:27:26.000 [notice] TLS error PR_CONNECT_RESET_ERROR while writing with [scrubbed]: TCP connection reset by peer
Aug 25 14:27:40.000 [notice] TLS error PR_CONNECT_RESET_ERROR while writing with [scrubbed]: TCP connection reset by peer
Aug 25 14:28:10.000 [notice] TLS error PR_CONNECT_RESET_ERROR while writing with [scrubbed]: TCP connection reset by peer
Aug 25 14:28:33.000 [notice] TLS error PR_CONNECT_RESET_ERROR while writing with [scrubbed]: TCP connection reset by peer
Aug 25 14:28:36.000 [notice] TLS error PR_CONNECT_RESET_ERROR while writing with [scrubbed]: TCP connection reset by peer
Aug 25 14:28:59.000 [notice] TLS error PR_CONNECT_RESET_ERROR while writing with [scrubbed]: TCP connection reset by peer
Aug 25 14:29:26.000 [notice] TLS error PR_CONNECT_RESET_ERROR while writing with [scrubbed]: TCP connection reset by peer
Aug 25 14:29:33.000 [notice] TLS error PR_CONNECT_RESET_ERROR while reading with 78.42.224.40:9001 ID=C1lV7a6ArdG1jQIwnPXgwMsWmInEiws3R0EGt6TXLxQ RSA_ID=841A6A7A53432F8A6B36D6A3083FE0E29899469C: TCP connection reset by peer
Aug 25 14:29:45.000 [notice] TLS error PR_CONNECT_RESET_ERROR while writing with [scrubbed]: TCP connection reset by peer

Re: Your TeaInside relay is failing to relay exit traffic

[Ammar Faizi]

On 8/25/22 2:33 PM, Louvian Lyndal wrote:
> I checked it, there are many TLS error here:
> 
>     TLS error PR_CONNECT_RESET_ERROR while writing with [scrubbed]: TCP
> connection reset by peer
> 
> I don't understand the reason behind this. Will investigate it.

Hmmm...

I doubt if this one is an issue from our side. As far I can tell, ECONNRESET
means the other side (the remote side) is terminating the connection. But of
course this can be a firewall issue or something that results in the Tor
daemon thinks so.

   (I still doubt if it's a firewall issue, though).

-- 
Ammar Faizi

Re: Your TeaInside relay is failing to relay exit traffic

[Georg Koppen]

[-- Attachment #1.1: Type: text/plain, Size: 1611 bytes --]

Ammar Faizi:
> On 8/25/22 1:58 PM, Georg Koppen wrote:
>> Hello!
>>
>> Your TeaInside relay[1] seems to fail relaying exit traffic
>> according to our measurements. We ran some tests and it was not possible
>> in 5/5 cases to reach e.g. https://torproject.org. Could you please look
>> into that and resolve the issue on your end?
>>
>> Please let us know if you have further questions and when the problem is
>> resolved on your side.
>>
>> Thanks for running relays!
>> Georg
>>
>> [1] 
>> https://metrics.torproject.org/rs.html#details/F241330F16AF6BD90226CC9130DA8E20B58AAC3B
> 
> Hi Georg,
> 
> Thanks for reporting this issue.
> 
> I will take a look into it. But before that, I have a question. How do I
> test my exit relay to see whether it's working properly?

There are different ways. One thing we do is to build circuits with the 
respective nodes to test as exits and then we try to connect to 
different websites and check whether there are any failures. In your 
case it seems connections are timing out.

Another way, which you could try is using Tor Browser with your node as 
exit node. For that, after you have downloaded Tor Browser and extracted 
it, add to your torrc file (in 
tor-browser_en-US/Browser/TorBrowser/Data/Tor):

ExitNodes F241330F16AF6BD90226CC9130DA8E20B58AAC3B

The start Tor Browser and try to surf to some websites like popular news 
sites etc. Those requests are frequently timing out or take super long 
to load resulting caused by lots of circuit churn (as the circuit fails 
due to timeouts).

Hope this helps,
Georg



[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: Your TeaInside relay is failing to relay exit traffic

[Ammar Faizi]

On 8/25/22 4:27 PM, Georg Koppen wrote:
> There are different ways. One thing we do is to build circuits with the
> respective nodes to test as exits and then we try to connect to
> different websites and check whether there are any failures. In your
> case it seems connections are timing out.
> 
> Another way, which you could try is using Tor Browser with your node as
> exit node. For that, after you have downloaded Tor Browser and extracted
> it, add to your torrc file (in
> tor-browser_en-US/Browser/TorBrowser/Data/Tor):
> 
> ExitNodes F241330F16AF6BD90226CC9130DA8E20B58AAC3B
> 
> The start Tor Browser and try to surf to some websites like popular news
> sites etc. Those requests are frequently timing out or take super long
> to load resulting caused by lots of circuit churn (as the circuit fails
> due to timeouts).

Great, thanks for the tips!

The latter way using Tor Browser sounds easier for me. I will
investigate this and be back to you soon.

-- 
Ammar Faizi

Re: Your TeaInside relay is failing to relay exit traffic

[Ammar Faizi]

On 8/25/22 5:13 PM, Ammar Faizi wrote:
> On 8/25/22 4:27 PM, Georg Koppen wrote:
>> There are different ways. One thing we do is to build circuits with the
>> respective nodes to test as exits and then we try to connect to
>> different websites and check whether there are any failures. In your
>> case it seems connections are timing out.
>>
>> Another way, which you could try is using Tor Browser with your node as
>> exit node. For that, after you have downloaded Tor Browser and extracted
>> it, add to your torrc file (in
>> tor-browser_en-US/Browser/TorBrowser/Data/Tor):
>>
>> ExitNodes F241330F16AF6BD90226CC9130DA8E20B58AAC3B
>>
>> The start Tor Browser and try to surf to some websites like popular news
>> sites etc. Those requests are frequently timing out or take super long
>> to load resulting caused by lots of circuit churn (as the circuit fails
>> due to timeouts).
> 
> Great, thanks for the tips!
> 
> The latter way using Tor Browser sounds easier for me. I will
> investigate this and be back to you soon.
Hi Georg,

I have been trying to investigate this for several days, but haven't been
able to fix the issue. Looking at the Tor daemon process from htop, it is
spinning at 100% CPU. I don't know what is going on, but as far as I can
tell, it is still consuming CPU and network I/O.

I tried to specify my relay fingerprint in torrc Tor browser like
what you said previously. My Tor browser didn't work. It was always
timing out with no clear error.

 From the server side, this is the last few hundred of lines of my Tor
daemon log:

    https://gist.githubusercontent.com/ammarfaizi2/40be0cb122b5ad1240f9001f8e58eb7d/raw/2407fc3063d786e3e0054d522a0e63323e35513e/tor_log.txt

Do you have any suggestion?

If you need more information to diagnose this, tell me what do you
need. I will happily provide it.

-- 
Ammar Faizi

Re: Your TeaInside relay is failing to relay exit traffic

[Georg Koppen]

[-- Attachment #1.1: Type: text/plain, Size: 2087 bytes --]

Ammar Faizi:
> On 8/25/22 5:13 PM, Ammar Faizi wrote:
>> On 8/25/22 4:27 PM, Georg Koppen wrote:
>>> There are different ways. One thing we do is to build circuits with the
>>> respective nodes to test as exits and then we try to connect to
>>> different websites and check whether there are any failures. In your
>>> case it seems connections are timing out.
>>>
>>> Another way, which you could try is using Tor Browser with your node as
>>> exit node. For that, after you have downloaded Tor Browser and extracted
>>> it, add to your torrc file (in
>>> tor-browser_en-US/Browser/TorBrowser/Data/Tor):
>>>
>>> ExitNodes F241330F16AF6BD90226CC9130DA8E20B58AAC3B
>>>
>>> The start Tor Browser and try to surf to some websites like popular news
>>> sites etc. Those requests are frequently timing out or take super long
>>> to load resulting caused by lots of circuit churn (as the circuit fails
>>> due to timeouts).
>>
>> Great, thanks for the tips!
>>
>> The latter way using Tor Browser sounds easier for me. I will
>> investigate this and be back to you soon.
> Hi Georg,
> 
> I have been trying to investigate this for several days, but haven't been
> able to fix the issue. Looking at the Tor daemon process from htop, it is
> spinning at 100% CPU. I don't know what is going on, but as far as I can
> tell, it is still consuming CPU and network I/O.
> 
> I tried to specify my relay fingerprint in torrc Tor browser like
> what you said previously. My Tor browser didn't work. It was always
> timing out with no clear error.
> 
>  From the server side, this is the last few hundred of lines of my Tor
> daemon log:
> 
>     
> https://gist.githubusercontent.com/ammarfaizi2/40be0cb122b5ad1240f9001f8e58eb7d/raw/2407fc3063d786e3e0054d522a0e63323e35513e/tor_log.txt
> 
> Do you have any suggestion?
> 
> If you need more information to diagnose this, tell me what do you
> need. I will happily provide it.

Hrm. What else is running on that server apart from the exit node? Could 
you share the torrc file you are using?

Georg



[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: Your TeaInside relay is failing to relay exit traffic

[Ammar Faizi]

On 8/30/22 6:02 PM, Georg Koppen wrote:
> Hrm. What else is running on that server apart from the exit node? Could 
> you share the torrc file you are using?

I run a single Tor process. Apart from the exit node, it runs:

    - TransPort
    - DNSPort
    - and many socks5 proxies

torrc file is:

   https://gist.githubusercontent.com/ammarfaizi2/7b6bef9eafc4c33085a893044eab8187/raw/38f47e88f812a7f092b3b5e8486399c59080d8d2/torrc.txt

-- 
Ammar Faizi

Re: Your TeaInside relay is failing to relay exit traffic

[Ammar Faizi]

On 8/30/22 6:14 PM, Ammar Faizi wrote:
> On 8/30/22 6:02 PM, Georg Koppen wrote:
>> Hrm. What else is running on that server apart from the exit node? Could you share the torrc file you are using?
> 
> I run a single Tor process. Apart from the exit node, it runs:
> 
>     - TransPort
>     - DNSPort
>     - and many socks5 proxies
> 
> torrc file is:
> 
>    https://gist.githubusercontent.com/ammarfaizi2/7b6bef9eafc4c33085a893044eab8187/raw/38f47e88f812a7f092b3b5e8486399c59080d8d2/torrc.txt
Hi Georg,

Follow up on this issue...

My exit node is now working properly. I also have just re-activated
the IPv6 support on it. My Tor browser is now working fine and I can
confirm the exit IP matches with my exit node server.

While I don't actually know the reason behind this issue, it's all
fixed now. I also learned more about Tor network.

Thanks for reporting and helping!

Please let me know if I missed something.

-- 
Ammar Faizi

Re: Your TeaInside relay is failing to relay exit traffic

[Ammar Faizi]

On 8/30/22 9:12 PM, Ammar Faizi wrote:
> Hi Georg,
> 
> Follow up on this issue...
> 
> My exit node is now working properly. I also have just re-activated
> the IPv6 support on it. My Tor browser is now working fine and I can
> confirm the exit IP matches with my exit node server.
> 
> While I don't actually know the reason behind this issue, it's all
> fixed now. I also learned more about Tor network.
> 
> Thanks for reporting and helping!
> 
> Please let me know if I missed something.

Hi,

After several hours running, my exit node is now marked as BadExit.
I am not sure what I did wrong.

I can perform outbound traffic just fine from my exit node server.
What is the real reason behind this?

Fingerprint: F241330F16AF6BD90226CC9130DA8E20B58AAC3B

Please help.

-- 
Ammar Faizi

Re: Your TeaInside relay is failing to relay exit traffic

[Georg Koppen]

[-- Attachment #1.1: Type: text/plain, Size: 1066 bytes --]

Ammar Faizi:
> On 8/30/22 6:14 PM, Ammar Faizi wrote:
>> On 8/30/22 6:02 PM, Georg Koppen wrote:
>>> Hrm. What else is running on that server apart from the exit node? 
>>> Could you share the torrc file you are using?
>>
>> I run a single Tor process. Apart from the exit node, it runs:
>>
>>     - TransPort
>>     - DNSPort
>>     - and many socks5 proxies
>>
>> torrc file is:
>>
>>    
>> https://gist.githubusercontent.com/ammarfaizi2/7b6bef9eafc4c33085a893044eab8187/raw/38f47e88f812a7f092b3b5e8486399c59080d8d2/torrc.txt
> Hi Georg,
> 
> Follow up on this issue...
> 
> My exit node is now working properly. I also have just re-activated
> the IPv6 support on it. My Tor browser is now working fine and I can
> confirm the exit IP matches with my exit node server.
> 
> While I don't actually know the reason behind this issue, it's all
> fixed now. I also learned more about Tor network.

Great, what did you change?

Georg

> Thanks for reporting and helping!
> 
> Please let me know if I missed something.
> 


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: Your TeaInside relay is failing to relay exit traffic

[Ammar Faizi]

On 8/31/22 1:37 PM, Georg Koppen wrote:
> Ammar Faizi:
>> On 8/30/22 6:14 PM, Ammar Faizi wrote:
>> My exit node is now working properly. I also have just re-activated
>> the IPv6 support on it. My Tor browser is now working fine and I can
>> confirm the exit IP matches with my exit node server.
>>
>> While I don't actually know the reason behind this issue, it's all
>> fixed now. I also learned more about Tor network.
> 
> Great, what did you change?

Too many things to tell. I adjusted several configurations in torrc.
Not sure what the issue was. But now my exit node is marked as BadExit
and can't relay exit traffic again (after previously several hour
working well).

Could you elaborate on what is going wrong? How to fix BadExit?

My current torrc is:

   https://gist.githubusercontent.com/ammarfaizi2/ac111834be4970d93af67bd6e861838e/raw/baf086007a2847ff8aec37867211883e74231e8b/torrc

Fingerprint: F241330F16AF6BD90226CC9130DA8E20B58AAC3B

-- 
Ammar Faizi

Re: Your TeaInside relay is failing to relay exit traffic

[Georg Koppen]

[-- Attachment #1.1: Type: text/plain, Size: 1252 bytes --]

Ammar Faizi:
> On 8/31/22 1:37 PM, Georg Koppen wrote:
>> Ammar Faizi:
>>> On 8/30/22 6:14 PM, Ammar Faizi wrote:
>>> My exit node is now working properly. I also have just re-activated
>>> the IPv6 support on it. My Tor browser is now working fine and I can
>>> confirm the exit IP matches with my exit node server.
>>>
>>> While I don't actually know the reason behind this issue, it's all
>>> fixed now. I also learned more about Tor network.
>>
>> Great, what did you change?
> 
> Too many things to tell. I adjusted several configurations in torrc.
> Not sure what the issue was. But now my exit node is marked as BadExit
> and can't relay exit traffic again (after previously several hour
> working well).
> 
> Could you elaborate on what is going wrong? How to fix BadExit?

The problem was that I still saw the same issues yesterday when testing 
and got the directory authorities to badexit your node as I did not know 
how long this problem persisted. I can redo my test later today and see 
how that goes.

In the meantime: could you elaborate on why you have the 
DNSPort/TransPort setup and those many SocksPorts configured? That's 
pretty unusual for a plan exit node setup and not needed.

Thanks,
Georg


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: Your TeaInside relay is failing to relay exit traffic

[Ammar Faizi]

On 8/31/22 2:25 PM, Georg Koppen wrote:
> Ammar Faizi:
>> On 8/31/22 1:37 PM, Georg Koppen wrote:
>>> Ammar Faizi:
>>>> On 8/30/22 6:14 PM, Ammar Faizi wrote:
>>>> My exit node is now working properly. I also have just re-activated
>>>> the IPv6 support on it. My Tor browser is now working fine and I can
>>>> confirm the exit IP matches with my exit node server.
>>>>
>>>> While I don't actually know the reason behind this issue, it's all
>>>> fixed now. I also learned more about Tor network.
>>>
>>> Great, what did you change?
>>
>> Too many things to tell. I adjusted several configurations in torrc.
>> Not sure what the issue was. But now my exit node is marked as BadExit
>> and can't relay exit traffic again (after previously several hour
>> working well).
>>
>> Could you elaborate on what is going wrong? How to fix BadExit?
> 
> The problem was that I still saw the same issues yesterday when testing
> and got the directory authorities to badexit your node as I did not know
> how long this problem persisted. I can redo my test later today and see
> how that goes.

I see, I understand, thanks!

> In the meantime: could you elaborate on why you have the
> DNSPort/TransPort setup and those many SocksPorts configured? That's
> pretty unusual for a plan exit node setup and not needed.

I run a VPN service that uses the transparent proxy and DNSPort in the
same server with the exit node. I also use the SOCKSPort to run my
scraper app.

Side note: The amount of the traffic from the VPN and SOCKS is fairly
small, it shouldn't affect my exit node.

Current usage:

   - A single small scrapper app (SOCKSPort).

     I configure many ports to get many exit IP addresses for
     randomizing my identity.

   - TeaVPN2 service (TransPort and DNSPort).

     I am writing a VPN software (Linux). It uses the transparent
     proxy and DNS port only for accessing "*.onion" host. Only
     3 people using it so far, rarely used too.

Is it fine doing that?

I can deploy a dedicated Tor instance for my VPN and scraper app if
it is really needed.

-- 
Ammar Faizi

Re: Your TeaInside relay is failing to relay exit traffic

[Ammar Faizi]

On 8/31/22 2:48 PM, Ammar Faizi wrote:
> On 8/31/22 2:25 PM, Georg Koppen wrote:
>> The problem was that I still saw the same issues yesterday when testing
>> and got the directory authorities to badexit your node as I did not know
>> how long this problem persisted. I can redo my test later today and see
>> how that goes. 

I am curious on what my exit relay is currently doing. I have a question:

What is my exit relay doing when it's marked as BadExit?

I still see the Tor daemon consuming CPU and network I/O despite it doesn't
relay exit traffic (per BadExit flag).

[
    I'm not a Tor expert, but I guess it acts as a guard or middle node.
    Doesn't it?

    #correct_me_if_i_am_wrong
]

-- 
Ammar Faizi

Re: Your TeaInside relay is failing to relay exit traffic

[Georg Koppen]

[-- Attachment #1.1: Type: text/plain, Size: 836 bytes --]

Ammar Faizi:
> On 8/31/22 2:48 PM, Ammar Faizi wrote:
>> On 8/31/22 2:25 PM, Georg Koppen wrote:
>>> The problem was that I still saw the same issues yesterday when testing
>>> and got the directory authorities to badexit your node as I did not know
>>> how long this problem persisted. I can redo my test later today and see
>>> how that goes. 
> 
> I am curious on what my exit relay is currently doing. I have a question:
> 
> What is my exit relay doing when it's marked as BadExit?
> 
> I still see the Tor daemon consuming CPU and network I/O despite it doesn't
> relay exit traffic (per BadExit flag).
> 
> [
>     I'm not a Tor expert, but I guess it acts as a guard or middle node.
>     Doesn't it?
> 
>     #correct_me_if_i_am_wrong

That's correct. It's just not used as an exit node.

Georg


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: Your TeaInside relay is failing to relay exit traffic

[Georg Koppen]

[-- Attachment #1.1: Type: text/plain, Size: 2997 bytes --]

Ammar Faizi:
> On 8/31/22 2:25 PM, Georg Koppen wrote:
>> Ammar Faizi:
>>> On 8/31/22 1:37 PM, Georg Koppen wrote:
>>>> Ammar Faizi:
>>>>> On 8/30/22 6:14 PM, Ammar Faizi wrote:
>>>>> My exit node is now working properly. I also have just re-activated
>>>>> the IPv6 support on it. My Tor browser is now working fine and I can
>>>>> confirm the exit IP matches with my exit node server.
>>>>>
>>>>> While I don't actually know the reason behind this issue, it's all
>>>>> fixed now. I also learned more about Tor network.
>>>>
>>>> Great, what did you change?
>>>
>>> Too many things to tell. I adjusted several configurations in torrc.
>>> Not sure what the issue was. But now my exit node is marked as BadExit
>>> and can't relay exit traffic again (after previously several hour
>>> working well).
>>>
>>> Could you elaborate on what is going wrong? How to fix BadExit?
>>
>> The problem was that I still saw the same issues yesterday when testing
>> and got the directory authorities to badexit your node as I did not know
>> how long this problem persisted. I can redo my test later today and see
>> how that goes.
> 
> I see, I understand, thanks!
> 
>> In the meantime: could you elaborate on why you have the
>> DNSPort/TransPort setup and those many SocksPorts configured? That's
>> pretty unusual for a plan exit node setup and not needed.
> 
> I run a VPN service that uses the transparent proxy and DNSPort in the
> same server with the exit node. I also use the SOCKSPort to run my
> scraper app.
> 
> Side note: The amount of the traffic from the VPN and SOCKS is fairly
> small, it shouldn't affect my exit node.
> 
> Current usage:
> 
>    - A single small scrapper app (SOCKSPort).
> 
>      I configure many ports to get many exit IP addresses for
>      randomizing my identity.

How is that supposed to work given that you only have one exit IP 
address (68.183.184.174)? And what are you actually scraping? One thing 
that makes me wonder is that we encounter more and more websites that 
deploy either total bans on Tor users or annoying CAPTCHAs etc. because 
of folks massively scraping their contents and because all simpler 
scraping solutions are already blocked. Are you aware of that issue? 
(FWIW: that is having a big impact on Tor's overall usability).

>    - TeaVPN2 service (TransPort and DNSPort).
> 
>      I am writing a VPN software (Linux). It uses the transparent
>      proxy and DNS port only for accessing "*.onion" host. Only
>      3 people using it so far, rarely used too.
> 
> Is it fine doing that?
> 
> I can deploy a dedicated Tor instance for my VPN and scraper app if
> it is really needed.

Well, "needed" might be to strong here but it is certainly encouraged to 
just relay Tor exit traffic with your server as whatever else you are 
running and doing on that box might affect that exit relay which in turn 
might impact (other) Tor users.

Georg



[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: Your TeaInside relay is failing to relay exit traffic

[Ammar Faizi]

On 8/31/22 8:37 PM, Georg Koppen wrote:
> Ammar Faizi:
>> On 8/31/22 2:25 PM, Georg Koppen wrote:
>>> In the meantime: could you elaborate on why you have the
>>> DNSPort/TransPort setup and those many SocksPorts configured? That's
>>> pretty unusual for a plan exit node setup and not needed.
>>
>> I run a VPN service that uses the transparent proxy and DNSPort in the
>> same server with the exit node. I also use the SOCKSPort to run my
>> scraper app.
>>
>> Side note: The amount of the traffic from the VPN and SOCKS is fairly
>> small, it shouldn't affect my exit node.
>>
>> Current usage:
>>
>>    - A single small scrapper app (SOCKSPort).
>>
>>      I configure many ports to get many exit IP addresses for
>>      randomizing my identity.
> 
> How is that supposed to work given that you only have one exit IP address
> (68.183.184.174)?

You misunderstood my email.

I use the SOCKSPort for scraping, this gives me random exit IP. It doesn't
use my exit IP for the scraper's outbound traffic. A simple way to use it
is like this (I expose the ports publicly, you can try it too):

```bash

for i in {64500..64599}; do
curl -4 https://ipecho.net/plain --proxy socks5://68.183.184.174:$i; echo;
done;

```

It's slow, but it works.

> And what are you actually scraping?

The current is actively fetching https://lore.kernel.org/io-uring/new.atom
every 30 seconds. I don't see this as a big deal for the Tor network anyway.

> One thing that makes me wonder is that we encounter more and more websites
> that deploy either total bans on Tor users or annoying CAPTCHAs etc. because
> of folks massively scraping their contents and because all simpler scraping
> solutions are already blocked. Are you aware of that issue?
> (FWIW: that is having a big impact on Tor's overall usability).

Yes, I am aware of this issue. I have been bitten by annoying CAPTCHAs, block,
etc. when using Tor network. So I understand.

>>    - TeaVPN2 service (TransPort and DNSPort).
>>
>>      I am writing a VPN software (Linux). It uses the transparent
>>      proxy and DNS port only for accessing "*.onion" host. Only
>>      3 people using it so far, rarely used too.
>>
>> Is it fine doing that?
>>
>> I can deploy a dedicated Tor instance for my VPN and scraper app if
>> it is really needed.
> 
> Well, "needed" might be to strong here but it is certainly encouraged to
> just relay Tor exit traffic with your server as whatever else you are
> running and doing on that box might affect that exit relay which in turn
> might impact (other) Tor users.

Understand, thanks!

-- 
Ammar Faizi

Re: Your TeaInside relay is failing to relay exit traffic

[Ammar Faizi]

On 8/31/22 9:02 PM, Ammar Faizi wrote:
> On 8/31/22 8:37 PM, Georg Koppen wrote:
>> Ammar Faizi:
>>> On 8/31/22 2:25 PM, Georg Koppen wrote:
>>>> In the meantime: could you elaborate on why you have the
>>>> DNSPort/TransPort setup and those many SocksPorts configured? That's
>>>> pretty unusual for a plan exit node setup and not needed.
>>>
>>> I run a VPN service that uses the transparent proxy and DNSPort in the
>>> same server with the exit node. I also use the SOCKSPort to run my
>>> scraper app.
>>>
>>> Side note: The amount of the traffic from the VPN and SOCKS is fairly
>>> small, it shouldn't affect my exit node.
>>>
>>> Current usage:
>>>
>>>    - A single small scrapper app (SOCKSPort).
>>>
>>>      I configure many ports to get many exit IP addresses for
>>>      randomizing my identity.
>>
>> How is that supposed to work given that you only have one exit IP address
>> (68.183.184.174)?
> 
> You misunderstood my email.
> 
> I use the SOCKSPort for scraping, this gives me random exit IP. It doesn't
> use my exit IP for the scraper's outbound traffic. A simple way to use it
> is like this (I expose the ports publicly, you can try it too):
> 
> ```bash
> 
> for i in {64500..64599}; do
> curl -4 https://ipecho.net/plain --proxy socks5://68.183.184.174:$i; echo;
> done;
> 
> ```
> 
> It's slow, but it works.
> 
>> And what are you actually scraping?
> 
> The current is actively fetching https://lore.kernel.org/io-uring/new.atom
> every 30 seconds. I don't see this as a big deal for the Tor network anyway.

Just addition to that, previously, Louvian (in the CC) was scraping nhentai.net
with those SOCKSPort(s). But it was not a massive traffic.

>> One thing that makes me wonder is that we encounter more and more websites
>> that deploy either total bans on Tor users or annoying CAPTCHAs etc. because
>> of folks massively scraping their contents and because all simpler scraping
>> solutions are already blocked. Are you aware of that issue?
>> (FWIW: that is having a big impact on Tor's overall usability).
> 
> Yes, I am aware of this issue. I have been bitten by annoying CAPTCHAs, block,
> etc. when using Tor network. So I understand.
> 
>>>    - TeaVPN2 service (TransPort and DNSPort).
>>>
>>>      I am writing a VPN software (Linux). It uses the transparent
>>>      proxy and DNS port only for accessing "*.onion" host. Only
>>>      3 people using it so far, rarely used too.
>>>
>>> Is it fine doing that?
>>>
>>> I can deploy a dedicated Tor instance for my VPN and scraper app if
>>> it is really needed.
>>
>> Well, "needed" might be to strong here but it is certainly encouraged to
>> just relay Tor exit traffic with your server as whatever else you are
>> running and doing on that box might affect that exit relay which in turn
>> might impact (other) Tor users.
> 
> Understand, thanks!
> 

-- 
Ammar Faizi

Re: Your TeaInside relay is failing to relay exit traffic

[Louvian Lyndal]

On 8/31/22 9:07 PM, Ammar Faizi wrote:
> On 8/31/22 9:02 PM, Ammar Faizi wrote:
>> On 8/31/22 8:37 PM, Georg Koppen wrote:
>>> Ammar Faizi:
>>>> On 8/31/22 2:25 PM, Georg Koppen wrote:
>>>> Current usage:
>>>>
>>>>    - A single small scrapper app (SOCKSPort).
>>>>
>>>>      I configure many ports to get many exit IP addresses for
>>>>      randomizing my identity.
>>>
>>> How is that supposed to work given that you only have one exit IP address
>>> (68.183.184.174)?
>>
>> You misunderstood my email.
>>
>> I use the SOCKSPort for scraping, this gives me random exit IP. It doesn't
>> use my exit IP for the scraper's outbound traffic. A simple way to use it
>> is like this (I expose the ports publicly, you can try it too):
>>
>> ```bash
>>
>> for i in {64500..64599}; do
>> curl -4 https://ipecho.net/plain --proxy socks5://68.183.184.174:$i; echo;
>> done;
>>
>> ```
>>
>> It's slow, but it works.
>>
>>> And what are you actually scraping?
>>
>> The current is actively fetching https://lore.kernel.org/io-uring/new.atom
>> every 30 seconds. I don't see this as a big deal for the Tor network anyway.
>
> Just addition to that, previously, Louvian (in the CC) was scraping nhentai.net
> with those SOCKSPort(s). But it was not a massive traffic.

I've stopped scraping it for a while, sometimes only running the
scraper when I want to download a specific gallery number from nh. but
yes, before it, the scraper was running a bit aggressively for content
collecting purpose

I'll stop doing that, I actually enjoy reading nh online more than
downloading. Our scraping activity (on nh) didn't actually have a
strong intention, it was just for fun collecting data and happy doing
code.

thanks,
lvldll

Re: Your TeaInside relay is failing to relay exit traffic

[Georg Koppen]

[-- Attachment #1.1: Type: text/plain, Size: 2132 bytes --]

Louvian Lyndal:
> On 8/31/22 9:07 PM, Ammar Faizi wrote:
>> On 8/31/22 9:02 PM, Ammar Faizi wrote:
>>> On 8/31/22 8:37 PM, Georg Koppen wrote:
>>>> Ammar Faizi:
>>>>> On 8/31/22 2:25 PM, Georg Koppen wrote:
>>>>> Current usage:
>>>>>
>>>>>     - A single small scrapper app (SOCKSPort).
>>>>>
>>>>>       I configure many ports to get many exit IP addresses for
>>>>>       randomizing my identity.
>>>>
>>>> How is that supposed to work given that you only have one exit IP address
>>>> (68.183.184.174)?
>>>
>>> You misunderstood my email.
>>>
>>> I use the SOCKSPort for scraping, this gives me random exit IP. It doesn't
>>> use my exit IP for the scraper's outbound traffic. A simple way to use it
>>> is like this (I expose the ports publicly, you can try it too):
>>>
>>> ```bash
>>>
>>> for i in {64500..64599}; do
>>> curl -4 https://ipecho.net/plain --proxy socks5://68.183.184.174:$i; echo;
>>> done;
>>>
>>> ```
>>>
>>> It's slow, but it works.
>>>
>>>> And what are you actually scraping?
>>>
>>> The current is actively fetching https://lore.kernel.org/io-uring/new.atom
>>> every 30 seconds. I don't see this as a big deal for the Tor network anyway.
>>
>> Just addition to that, previously, Louvian (in the CC) was scraping nhentai.net
>> with those SOCKSPort(s). But it was not a massive traffic.
> 
> I've stopped scraping it for a while, sometimes only running the
> scraper when I want to download a specific gallery number from nh. but
> yes, before it, the scraper was running a bit aggressively for content
> collecting purpose
> 
> I'll stop doing that, I actually enjoy reading nh online more than
> downloading. Our scraping activity (on nh) didn't actually have a
> strong intention, it was just for fun collecting data and happy doing
> code.

I see. Anyway, the DNS issue seems indeed resolved, thanks! I pushed a 
commit to get the badexit flag removed. Once a majority of directory 
authorities has picked it up your relay will be used as an exit again. 
(That might take a couple of hours at least, though)

Thanks for running relays,
Georg


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: Your TeaInside relay is failing to relay exit traffic

[Ammar Faizi]

On 8/31/22 9:46 PM, Georg Koppen wrote:
> Louvian Lyndal:
>> I'll stop doing that, I actually enjoy reading nh online more than
>> downloading. Our scraping activity (on nh) didn't actually have a
>> strong intention, it was just for fun collecting data and happy doing
>> code.
> 
> I see. Anyway, the DNS issue seems indeed resolved, thanks! I pushed a 
> commit to get the badexit flag removed. Once a majority of directory 
> authorities has picked it up your relay will be used as an exit again. 
> (That might take a couple of hours at least, though)
> 
> Thanks for running relays,
> Georg

Blissful running Tor relays, thanks for the help!

-- 
Ammar Faizi