[HN Gopher] Expose server behind NAT with Tor
___________________________________________________________________
Expose server behind NAT with Tor
Author : marcodiego
Score : 71 points
Date : 2022-01-14 01:18 UTC (21 hours ago)
(HTM) web link (golb.hplar.ch)
(TXT) w3m dump (golb.hplar.ch)
| [deleted]
| unstatusthequo wrote:
| How about ngrok? Works great.
| geoffeg wrote:
| Another option is a VPN as a service solution like tailscale.
| Tailscale does a lot of work to get around NAT and has some great
| articles on their blog about it. https://tailscale.com/blog/how-
| nat-traversal-works/
| wjkohnen wrote:
| Oh I love tailscale, it is so performant and just works
| (mostly). However, I have used Tor for many years for this use
| case and still have it around as a fallback for machines that
| can be hard to reach spatially.
| wernerb wrote:
| Wireguard is performant, tailscale makes it convenient
| nextfx wrote:
| Is there a way of doing NAT hole-punching with Wireguard?
| superkuh wrote:
| Every single tor .onion URL in this article no longer works in
| Tor clients. Why? Because the tor project decided to throw away
| 15 years of communities and interlinking and search indices just
| to make sure people don't accidentally use tor v2 (which is still
| more secure than the clear web) and force them to use the far
| more secure tor v3 (an entirely new network). They did this in
| Oct/Nov 2021 after a couple years of warning of depreciation (not
| deletion).
| neilalexander wrote:
| The main downside to this is that performance will generally be
| quite bad. Tor trades performance for anonymity. Unless you
| specifically need anonymity -- which is highly unlikely when you
| are just trying to reach back to a host of your own behind a NAT
| -- there probably isn't any benefit in using Tor.
| jancsika wrote:
| Suppose I've got an RPI and I want to ssh into it from anywhere
| in the world.
|
| If I ssh into it through a hidden service then the hidden
| service address IS its canonical address, regardless of whether
| I'm sitting in the living room or on the international space
| station.
|
| As it turns out I don't need to log in to my RPI from the ISS.
| But if I _did_ need that, good luck explaining to me how to do
| that with impunity using a pile of brittle Linux
| configurations. Tell me how to do it and I bet I 'll fuck it
| up.
| iso1631 wrote:
| $ ssh 123.45.67.8
|
| Assuming there's internet on the ISS
| jancsika wrote:
| I didn't write it explicitly, but I was describing ssh'ing
| to an RPI behind a NAT as most residential U.S. internet
| is. In that case 123.45.67.8 won't help you.
|
| In fact, I think the comment I was responding to understood
| my meaning and retroactively edited their comment to
| include the part between the dashes about accessing a compy
| behind a NAT. GP-- did you do that or am I imagining
| things?
|
| Anyway, I agree with that comment as written-- if you don't
| ever need to care about breaking through NATs, Tor isn't a
| big benefit. (But there are, however, a large number of
| situations where users do care about NATs. GP only
| mentioned the one I had in mind. So I don't agree with the
| greater upshot of anonymity being the determining factor in
| Tor use.)
| iso1631 wrote:
| And IPv6?
| pixl97 wrote:
| You may underestimate how many US ISPs are behind NAT and
| don't give out IPv6
| monocasa wrote:
| There is. They look like they're coming from a ground
| station to geoip.
| iso1631 wrote:
| I guess it would be a hassle updating geoip databases
| every few seconds with a new location :D
| derefr wrote:
| That use-case is exactly what I use https://www.zerotier.com/
| for -- SSHing into my NAS from anywhere in the world. And
| there's _less_ configuration involved than setting up a Tor
| hidden service.
| yjftsjthsd-h wrote:
| > And there's _less_ configuration involved than setting up
| a Tor hidden service.
|
| Is there really? IIRC zerotier saves you having to fiddle
| around with keys, which is a pain, but you still need to
| set up the daemon, and zerotier requires you to go make an
| account instead of just generating keys and copying them to
| your client, which feels like rather more friction.
| jstanley wrote:
| You can't say there "isn't any benefit" in using Tor without
| saying what you're comparing against.
|
| OP had a problem, and solved it using Tor. Suggesting there
| isn't any benefit in using Tor, without offering an
| alternative, is to suggest that you just shouldn't solve the
| problem.
|
| Of _course_ there 's a benefit in using Tor: it gets you
| through NAT for free! It also gets you end-to-end encryption
| for free.
| neilalexander wrote:
| I am not saying you shouldn't solve the problem. I am saying
| that Tor is probably not the best tool available for the task
| if you don't specifically care about anonymity and there are
| more efficient tools available.
|
| Zerotier is one example, Cloudflare Argo is another, tinc is
| another, Yggdrasil is another, Tailscale is another. Some VPN
| providers (like Mullvad) will happily forward ports to you
| from their VPN servers. As the author linked to at the very
| beginning of their post, you could even set up something
| similar by hand with a VPS (free-tier would suffice) and off-
| the-shelf VPN software like Wireguard.
| mikotodomo wrote:
| I use Tor and it's fast.
| crtasm wrote:
| I'd still recommend trying it - performance is good enough for
| my needs.
|
| Is there still an onion service config option to use 3 hops
| instead of 6? I can't find the documentation on the current tor
| project website.
|
| edit: found it in the manpage: HiddenServiceSingleHopMode
| system33- wrote:
| Disable the SocksPort, then set two options to _really_
| convince tor that you know what you 're doing, then configure
| your onion service as usual. SocksPort 0
| HiddenServiceSingleHopMode 1
| HiddenServiceNonAnonymousMode 1 HiddenServiceDir
| /var/lib/tor/ssh_service HiddenServicePort 22
| HiddenServiceDir /var/lib/tor/http_service
| HiddenServicePort 80
| zxcvbn4038 wrote:
| By default it is six hops for complete circuit between client
| and hidden service. Three hops from client to rendezvous
| point, then three hops from rendezvous point to the hidden
| service. If you go below that you might as well host on the
| public internet.
| ycuser2 wrote:
| If the main goal is not anonymity this should not be a
| problem?
| arpa wrote:
| hasn't Tor performance improved over the years? i mean, it
| still doesn't make sense to use torrents over it, but for ssh
| and maybe some light file transfer it should be enough, no?
| jandrese wrote:
| Tor performance is really not that bad. Hidden services are
| worse because they effectively go through the network twice,
| but even then it's generally acceptable. People have the
| impression that it's like going back to a modem, but it's
| more like going to a laggy DSL connection.
| throwaway_moon wrote:
| Another benefit is that Tor has built-in load balancing and
| failover.
|
| You can use it with onionbalance.
| anderspitman wrote:
| There are essentially 3 ways proxy tunneling like this is done:
|
| 1. The Tor method mentioned in this article - Will probably be
| the worst performance but it's free and offers some privacy
| features.
|
| 2. VPN - WireGuard (Tailscale is popular), OpenVPN, IPsec etc.
| Best performance, but requires some low-level configuration on
| both the client and server. You'll probably need admin privileges
| on the client to configure network interfaces. This is usually
| automated in practice. If you're on network that blocks UDP, that
| can also be an issue. You also need a server with a public IP,
| which generally you'll have to pay for.
|
| 3. User-space tunnels - Solutions like SSH remote port
| forwarding, ngrok, etc. Convenient because on the client you
| don't need elevated privileges. Performance will likely be
| somewhere between Tor and VPN. Although note that unless you have
| very fast internet upload speeds, tunnel performance isn't likely
| to be your bottleneck. Many solutions multiplex over a single TCP
| connection, which can cause issues in lossy network conditions
| due to head-of-line blocking. You need a server with a public IP
| just like with a VPN.
|
| I maintain a list of proxy tunneling solutions here:
|
| https://github.com/anderspitman/awesome-tunneling
| _wldu wrote:
| If you use Tor, you should stop. I believe that it is mostly used
| by criminals and that it is largely ran by law enforcement
| agencies. I cannot prove this but I believe it is true. Simply
| using it makes you suspect.
|
| Also, if you have a need to use Tor for work purposes, get
| written permission from your senior management and describe
| exactly what you will do while using Tor (scan our hosts
| externally, test our firewall rules, find exposed services or
| mis-configured systems, etc.).
|
| If your goal is to be anonymous while surfing the Internet, find
| some other way, but stop using Tor for that.
| keyme wrote:
| If you use Tor, and you're not a criminal, you increase the
| deniability of anyone else who uses Tor. Thus, ever so
| slightly, you help everyone else to have an easy way to be
| anonymous.
|
| Of course, for any serious anonymity (against western LEAs, not
| against corporations or 3rd world governments), you're most
| likely correct.
| ranger_danger wrote:
| Guns are mostly used by criminals. You should stop.
|
| /s
| karmanyaahm wrote:
| Criminals drink water. You should stop drinking water right
| now if you don't want to turn into a criminal!
|
| /s
| nullenvk wrote:
| Remember, US dollars are used by criminals too. /s
| anon9001 wrote:
| If you don't use tor, you should start. I believe that it is
| mostly used by oppressed populations and that it is largely ran
| by parties that get utility from anonymity (activists, spies,
| law enforcement). I cannot prove this but I believe it is true.
| Simply using tor increases all of our security.
|
| Also, if you have the option to use for work purposes, get your
| organization to consider contributing to tor. If you find
| utility in it, consider running additional nodes.
|
| If your goal is for anonymity to be possible on the internet,
| start using tor wherever you can.
|
| There, I fixed it for you ;)
| superkuh wrote:
| Unfortunately the Tor Project agrees with you. They value
| privacy and security far more than a stable address. The
| destruction of the entire tor .onion web in Oct/Nov 2021 was
| pretty much the last straw. The Tor Project only cares about
| shady people. Anyone wanting to use it for a stable .onion
| address for their non-private communities should stop using
| tor.
| kevin_nisbet wrote:
| For some reason I'm under the impression that onion services were
| discoverable, or partially discoverable by relay operators, or
| some such. IT's been quite awhile though and I think there was
| some talk of changing that.
|
| Does anyone know if that has changed? Last time someone suggested
| to me, which was several years ago, it didn't seem to have the
| security properties the person suggesting the approach thought it
| had, specifically that tor was adding security via the onion
| service.
|
| Anyone have up to date information?
| madars wrote:
| I think for v2 onions (removed from Tor since this past Fall)
| HSDir operators could enumerate them, but v3 onions (ones in
| use now) should be resistant to that. I'm not sure how strongly
| resistant though.
| bumblebeast wrote:
| https://www.hackerfactor.com/blog/index.php?/categories/19-T.
| ..
|
| Still some vulnerability with v3. :(
___________________________________________________________________
(page generated 2022-01-14 23:01 UTC)