The State of IPv6 support on the Tor network | Hacker News Reader

The State of IPv6 support on the Tor network

blog.torproject.org

97 pointspabs326 comments

At this point, the state of IPv6 support in Tor is already pretty good. IPv4-only clients can access IPv6-only sites, and IPv6-only clients can access IPv4-only sites. No configuration is needed. It actually makes Tor an useful 4to6 bridge. Also, hosting Onion Service on a pure IPv6 network is possible and should be reachable by everyone, opening up some possibilities (just like Onion Service behind a NAT opens up possibilities).

It's surprising how many ipv4 problems tor can solve if you're network is a mess. I used to use it all the time in college to ssh back into my laptop/desktop when I didn't have a public ipv4 address.

I wonder who is actually hosting tor exit nodes. I doubt anyone is hosting them on their home network since that would be asking to be blocked from every website at the least.

I have considered running a relay node but I'm not even sure how safe that is.

I have been running a relay node from my home network for 5 months now. Aside from sometimes melting my cheap router with concurrent connections I did not notice anything out of ordinary.

Relay nodes are unobjectionable. Nothing interesting happens as far as your neighbours are concerned, traffic passes in and out of your node, but that's true for any number of application protocols of no interest.

However the comment you're replying to talks about exit nodes, these are potentially obnoxious for your neighbours, as from them of course emerges traffic that somebody else didn't want to admit to sending.

Now, perhaps it's a young gay guy in a country where homosexuality is illegal, reading an essay by someone who has been in a similar situation.

Or a fourteen year old looking at pornography bypassing a "family filter"

But more likely it's vandals trying to replace every mention of a pop star they don't like on Wikipedia with the words "Jerk Poop-head", a spammer sending piles of unsolicited commercial email, or a botnet operator trying to send C&C packets to direct a DDoS.

For this you will of course get blocked by various services, and explaining it isn't actually you might prevent getting arrested in many jurisdictions, but won't mean everybody lets you use their services from this obviously tainted connection.

So, doing that on your personal ISP connection is probably a bad idea.

Wikipedia blocks all editing from Tor exit nodes. You even have to apply for IP block exemption when you want to edit from Tor while logged in.

I'd like to highlight the point you made about running a non-exit node from your home network: they're unobjectionable.

Running any node strengthens the TOR network as it provides more anonymous paths for users to connect through. Since running a middle node from home doesn't cause any issues for you, doing so is a great way to contribute to the network.

If you have a machine that's always on, has slightly higher specs, and you have slightly higher network speeds too, you might consider running an entry node instead.

How much traffic does a relay node use? Some residential ISPs have data caps. I know Cox has one for a terabyte or something.

That's a no brainer

https://support.torproject.org/operators/limit-total-bandwid...

What's the difference between a relay and entry node (shouldn't these be indistinguishable, I thought that was part of the point of Tor)? Unless by "entry node" you mean bridge?

Better question. Why aren't organisations like Amnesty International, Médecins Sans Frontières, Reporters Without Borders, and even the UN hosting Tor exit nodes? Why do humanitarian organisations not put their speech into practice but leave it to unknown "volunteers" to put up exit nodes?

why would you trust those specific organizations? politics is strong everywhere. UN is the worst of them.

The UN is big, just like a big megacorp, different groups are different. A few of them could take up the initiative.

Ignoring that those orgs will probably have high ranks if you asked a random sample of people about trust, what's the actual difference between them and anyone else?

As long as you are using tls and avoiding packet injection there's little difference. I'm sure plenty of governments own exit nodes themselves. Good on them for contributing to the network.

> I wonder who is actually hosting tor exit nodes

This 2015 Vice article attempts to answer that question: https://www.vice.com/en/article/5394ax/the-operators

TL;DR: "most of these exits are set up by volunteers, or 'operators.' A few organizations maintain the larger exits, a number of universities have their own, and individual activists run some too."

I've run relays for years with zero problems. It's easy: `sudo snap install tor-middle-relay`

In France we have the not-for-profit "Nos Oignons" :

https://nos-oignons.net/

https://nos-oignons.net/%C3%80_propos/index.en.html

It collects donations and pays for hosting of ToR exit nodes in various ISP, mostly not-for-profit too:

https://nos-oignons.net/Services/index.fr.html

It's now about 0.6% exit probably through their node.

Outside of managing donation money and the technical platform their main task is to answer judiciary requests.

Detailed activity report (in French):

https://nos-oignons.net/Association/

Disclaimer: I'm a volunteer for one of the nor-for-profit hoster for Nos Oignons.

I run an IPv6 enabled exit node and sniff the traffic for research purposes. The vast majority of the traffic is end-to-end encrypted and what's not has not been particularly revealing or illegal.

You don't have to run an exit node to help. Just run a guard / middle node. I have been running nodes at home and in data centers since at least 2014 and the only problems i had was one site that redirected me to their .onion site because it thought i was using Tor and once I couldn't access a website because it was hosted in China which blocks all IPs that host Tor nodes.

For Exit nodes it's more complicated. You should read at least [0][1][2] before thinking about running one.

[0]: https://community.torproject.org/relay/community-resources/t...

[1]: https://blog.torproject.org/tips-running-exit-node

[2]: https://community.torproject.org/relay/community-resources/e...

tl;dr for that is that you shouldn't run an exit node unless you already know exactly what you're getting into

If you want to support Tor you could rent a cheap 3$/month VPS and start a non-exit Tor relay there. Many providers will allow you to host a non-exit relay. I do so for years without any issues. Just check that you stay within your traffic limits.

I hosted one in my student apartment, it meant spammy ads asking me meet up with women who also lived in 'A1 Anonymous Proxy'.

That was 10 years ago, I've run both exits and relays since then.

I'm running the apx exit node family since about 2015.

For the first few years I've been a regular visitor to the local police (my ISP Hetzner at that time gave my name and address out), but eventually Hetzner banned me for generating too many abuse-tickets for them, which is unfortunate but clearly understandable.

I moved all the servers to a colocated rack in a datacenter in Amsterdam (Netherlands) and haven't had a problem since. But I guess that's only possible because I'm able to deal with the abuse messages directly now.

That said, the servers are handling a few terabytes per day each but I still have only received two abuse messages in the last 2 years. I don't know if that's related to the fact that people complain less now than they did in 2015 and 2016, or that the exit nodes now clearly indicate they are exit nodes (when opening their IP or hostname with a browser).

I have a .onion running on ipv6-only host and it's been working fine for the past few months. Relevant torrc configs:

  HiddenServicePort 80 [::1]:8080
  ClientUseIPv4 0
  ClientUseIPv6 1
  ClientPreferIPv6ORPort 1

One thing that is missing with IPv6 is an official list of all IPv6 exit nodes, which means those exits cannot be automatically allowed/denied unless that happens on the basis of behaviour instead of address.

As someone who set up a TOR relay in the last few days, I was surprised to see TOR primarily using IPv4.

It's good to see there's progress in IPv6 support and it seems to be coming sooner rather than later.

Reply on news.ycombinator.com