oxeo0/blog-contributions
1
0
Fork 0
mirror of http://git.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/nihilist/blog-contributions.git synced 2025-07-02 11:56:40 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
blog-contributions/opsec/tor/bridge/index.html
oxeo0 82b0b18512 fix-tor-guides
2025-04-23 15:41:43 +02:00

345 lines
17 KiB
HTML
Raw Blame History

<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<meta name="description" content="">
<meta name="author" content="">
<link rel="shortcut icon" href="../../../../../../assets/img/favicon.png">
<title>TOR Bridge</title>
<!-- Bootstrap core CSS -->
<link href="../../../assets/css/bootstrap.css" rel="stylesheet">
<link href="../../../assets/css/xt256.css" rel="stylesheet">
<script src="../../../assets/js/highlight.pack.js"></script>
<!-- Custom styles for this template -->
<link href="../../../assets/css/main.css" rel="stylesheet">
<!-- HTML5 shim and Respond.js IE8 support of HTML5 elements and media queries -->
<!--[if lt IE 9]>
<script src="https://oss.maxcdn.com/libs/html5shiv/3.7.0/html5shiv.js"></script>
<script src="https://oss.maxcdn.com/libs/respond.js/1.3.0/respond.min.js"></script>
<![endif]-->
</head>
<body>
<!-- Static navbar -->
<div class="navbar navbar-inverse-anon navbar-static-top">
<div class="container">
<div class="navbar-header">
<button type="button" class="navbar-toggle" data-toggle="collapse" data-target=".navbar-collapse">
<span class="icon-bar"></span>
<span class="icon-bar"></span>
<span class="icon-bar"></span>
</button>
<a class="navbar-brand-anon" href="\index.html">The Nihilism Opsec Blog</a>
</div>
<div class="navbar-collapse collapse">
<ul class="nav navbar-nav navbar-right">
<li><a href="/about.html">About</a></li>
<li><a href="/blog.html">Categories</a></li>
<li><a href="/contact.html">Contact</a></li>
</ul>
</div><!--/.nav-collapse -->
</div>
</div>
<!-- +++++ Posts Lists +++++ -->
<!-- +++++ First Post +++++ -->
<div id="anon2">
<div class="container">
<div class="row">
<div class="col-lg-8 col-lg-offset-2">
<a href="../../index.html">Previous Page</a></br></br> <p><img src="../../../assets/img/user.png" width="50px" height="50px"> <ba>nihilist - 01 / 02 / 2024</ba></p>
<h1>TOR Bridge (November 2024 update)</h1>
<img src="../logo.png" class="imgRz">
<p> Before we start, you will need a Debian VPS (you can get one on digitalocean for example), if you prefer to use your own self hosted server, make sure that port 80 and 443 are correctly port forwarded so that the public ip points to the server and not the router. Once that's done, go and ssh into your Debian server. </p>
<p><img src="../../logos/daturagit.png" style="width:100px"> <u>Sidenote:</u> Help us improve this tutorial by letting us know if there's anything missing or incorrect on this <a href="http://git.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/nihilist/blog-contributions/issues/100">git issue</a> directly!</p>
</div>
</div><!-- /row -->
</div> <!-- /container -->
</div><!-- /grey -->
<!-- +++++ Second Post +++++ -->
<div id="anon3">
<div class="container">
<div class="row">
<div class="col-lg-8 col-lg-offset-2">
<h2><b>Initial Setup </b></h2>
<p>
Log into your Debian server and add Tor repository.<br>
This will allow you to update your Tor daemon to latest versions just after they're released. It's not recommended to use <b>tor</b> package from Debian repository since it's usually out of date.<br>
To do that, <a href="https://support.torproject.org/apt/tor-deb-repo/">check the steps on Tor project's website</a>. Commands I run are listed below, but they may change in the future.
</p>
<pre><code class="nim">root@Datura:~# apt update -y && apt upgrade -y
root@Datura:~# apt install apt-transport-https curl tmux vim obfs4proxy gnupg2 -y
root@Datura:~# cat /etc/apt/sources.list | head -n3
deb [signed-by=/usr/share/keyrings/deb.torproject.org-keyring.gpg] https://deb.torproject.org/torproject.org bookworm main
deb-src [signed-by=/usr/share/keyrings/deb.torproject.org-keyring.gpg] https://deb.torproject.org/torproject.org bookworm main
root@Datura:~# wget -qO- https://deb.torproject.org/torproject.org/A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc | gpg --dearmor | tee /usr/share/keyrings/deb.torproject.org-keyring.gpg >/dev/null
root@Datura:~# apt update -y
root@Datura:~# apt install tor nyx
</code></pre>
<p>
To configure tor we need to edit the configuration file with the following entry. Replace the TODOs with the port numbers you wish to use
Edit tor configuration file:</p>
<pre><code class="nim">root@Datura:~# vim /etc/tor/torrc
#Added configuration
BridgeRelay 1
# Replace "TODO1" with a Tor port of your choice.
# This port must be externally reachable.
# Avoid port 9001 because it's commonly associated with Tor and censors may be scanning the Internet for this port.
ORPort 37051
ServerTransportPlugin obfs4 exec /usr/bin/obfs4proxy
# Replace "TODO2" with an obfs4 port of your choice.
# This port must be externally reachable and must be different from the one specified for ORPort.
# Avoid port 9001 because it's commonly associated with Tor and censors may be scanning the Internet for this port.
ServerTransportListenAddr obfs4 0.0.0.0:8042
# Local communication port between Tor and obfs4. Always set this to "auto".
# "Ext" means "extended", not "external". Don't try to set a specific port number, nor listen on 0.0.0.0.
ExtORPort auto
# Replace "<address@email.com>" with your email address so we can contact you if there are problems with your bridge.
# This is optional but encouraged.
ContactInfo nihilist@nowhere.moe
# Pick a nickname that you like for your bridge. This is optional.
Nickname Nihilist
</code></pre>
<p>Then restart the tor service + enable it:</p>
<pre><code class="nim">#Restart service
root@Datura:~# systemctl restart tor@default
#Enable at boot
root@Datura:~# systemctl enable --now tor@default
</code></pre>
</div>
</div><!-- /row -->
</div> <!-- /container -->
</div><!-- /white -->
<div id="anon2">
<div class="container">
<div class="row">
<div class="col-lg-8 col-lg-offset-2">
<h2><b>Nyx monitoring</b></h2> </br> </br>
<p>Once it finished installing, you can monitor your tor bridge node activity with nyx:</p>
<pre><code class="nim">root@Datura:~# sudo -u debian-tor nyx</code></pre>
<img src="4.png" class="imgRz">
</div>
</div><!-- /row -->
</div> <!-- /container -->
</div><!-- /white -->
<!-- +++++ Second Post +++++ -->
<div id="anon1">
<div class="container">
<div class="row">
<div class="col-lg-8 col-lg-offset-2">
<h2><b>Using your own bridge</b></h2> </br> </br>
<p>Next install tor-browser (in arch linux you can do it from the AUR), if not just go to the <a href="https://www.torproject.org/download/">downloads</a> page.</p>
<pre><code class="nim">
yay -S torbrowser-launcher
</code></pre>
<img src="5.png" class="imgRz">
<p>Then Launch it, and go in your preferences:</p>
<img src="6.png" class="imgRz">
<img src="7.png" class="imgRz">
<p>Here specifying your own bridge is not that simple, you need to use the following syntax:</p>
<pre><code class="nim">
Bridge obfs4 <<b></b>IP ADDRESS>:<<b></b>PORT> <<b></b>FINGERPRINT> cert=<<b></b>CERTIFICATE> iat-mode=0
</code></pre>
<p>First find the ip address of your server:</p>
<pre><code class="nim">
root@debian-s-1vcpu-1gb-lon1-01:~# curl ifconfig.me && echo && echo
<b>134.209.26.190</b>
</code></pre>
<p>Next find the port :</p>
<pre><code class="nim">
sudo -u debian-tor nyx
</code></pre>
<p>Just hit right arrow 3 times to get to your torrc config preview:</p>
<img src="8.png" class="imgRz">
<p>And here we have port <b>8042</b>. Next we need the fingerprint which is at page 1 of nyx, so press leftarrow to get back to page 1 and then scroll down using the downarrow:</p>
<img src="9.png" class="imgRz">
<p>Here it is <b>829165B21621041E7A9CDF7192AFFC51CA640B0E</b>, be careful not to copy the other one above which is the HASHED identity key. Here we want the original identity key fingerprint.
After this, we need the server's certificate:</p>
<pre><code class="nim">
root@debian-s-1vcpu-1gb-lon1-01:~# cat /var/lib/tor/pt_state/obfs4_bridgeline.txt
# obfs4 torrc client bridge line
#
# This file is an automatically generated bridge line based on
# the current obfs4proxy configuration. EDITING IT WILL HAVE
# NO EFFECT.
#
# Before distributing this Bridge, edit the placeholder fields
# to contain the actual values:
# <<b></b>IP ADDRESS> - The public IP address of your obfs4 bridge.
# <<b></b>PORT> - The TCP/IP port of your obfs4 bridge.
# <<b></b>FINGERPRINT> - The bridge's fingerprint.
Bridge obfs4 <<b></b>IP ADDRESS>:<<b></b>PORT> <<b></b>FINGERPRINT> <b>cert=L04rcSpDJb9xdGUy/LgAlxbNgtQUWPJFsdF3q2i8lKRmzffiVFJU5ARjr4RYXRZSrsNYXg iat-mode=0</b>
</code></pre>
<p>Here in this case we need the last part: <b>cert=L04rcSpDJb9xdGUy/LgAlxbNgtQUWPJFsdF3q2i8lKRmzffiVFJU5ARjr4RYXRZSrsNYXg iat-mode=0</b></p>
<p>And so we combine it all to get the string we need:</p>
<pre><code class="nim">
Bridge obfs4 134.209.26.190:8042 829165B21621041E7A9CDF7192AFFC51CA640B0E cert=L04rcSpDJb9xdGUy/LgAlxbNgtQUWPJFsdF3q2i8lKRmzffiVFJU5ARjr4RYXRZSrsNYXg iat-mode=0
</code></pre>
<p>Paste it in and hit "new identity":</p>
<img src="10.png" class="imgRz">
<p>Then we check if it is working on <a href="https://check.torproject.org/">check.torproject.org</a>:</p>
<img src="11.png" class="imgRz">
<p>And that's it! we have been able to use our own VPS-hosted tor bridge!</p>
<p>If you want to use the bridge from torrc you can do as follows:</p>
<pre><code class="nim">
nihilist@mainpc: ~$ vim /etc/tor/torrc
nihilist@mainpc: ~$ cat /etc/tor/torrc
UseBridges 1
ClientTransportPlugin obfs4 exec /usr/local/bin/obfs4proxy managed
Bridge obfs4 134.209.26.190:8042 829165B21621041E7A9CDF7192AFFC51CA640B0E cert=L04rcSpDJb9xdGUy/LgAlxbNgtQUWPJFsdF3q2i8lKRmzffiVFJU5ARjr4RYXRZSrsNYXg iat-mode=0
nihilist@mainpc: ~$ systemctl restart tor@default
</pre></code>
<p>Now keep in mind that obfs4 traffic simply looks like random data on the outside, it doesn't look like legit https traffic when doing deep-packet inspection. Therefore for heavily-censored countries, we recommend you use snowflake bridges:</p>
</div>
</div><!-- /row -->
</div> <!-- /container -->
</div><!-- /white -->
<div id="anon2">
<div class="container">
<div class="row">
<div class="col-lg-8 col-lg-offset-2">
<h2><b>Snowflake bridge theory</b></h2> </br> </br>
<p>As time goes to 2024 censorship becomes more advanced, and sometimes snowflake protocol works better than obfs4. We will go through theories and setup about snowflake bridge</p>
<p>For a normal tor connection without bridge, you will:</p>
<p>1.Talk to central directory</p>
<p>2.Get network information</p>
<p>3.Connect to your gurad nodes, and form tor circuits</p>
<img src="snowflake-migrate/normal_tor_connection.png" class="imgRz" style="width: 700px">
<p>If tor network is blocked, you cannot talk to central directory or any tor node ip, then you need a <b>bridge</b></p>
<p>All of your communication goes through the bridge, including your initial talk to central directory, and your bridge automatically becomes your first tor node</p>
<img src="snowflake-migrate/bridge.png" class="imgRz" style="width: 600px">
<p>Bridges are usually not publicly announced for censorship resistance, since once a bridge ip get known by censoring firewall it can simply drop all the packets to that ip</p>
<p>This is the weakness for traditional tor bridges, not matter how hard you try to obfuscate your traffic, the <b>bridge ip </b>always have to be semi-public because you want people to use it, but this means people who work for censorship can also find bridge ip</p>
<p>To end this cat and mouse game, snowflake is introduced</p>
<img src="snowflake-migrate/snowflake-schematic.png" class="imgRz" style="width: 700px">
<p>This is a picture of how snowflake works from tor official</p>
<p>First you have volunteers over the world who install snowflake plugin in their browsers, they act as bridges for you to connect to tor network. Because this is mostly run by amateurs, and people turn on and off their devices all the time, which makes many ephemeral bridges, and this is why it is called snowflake</p>
<p>There is also a server called broker that knows all the information about snowflakes</p>
<img src="snowflake-migrate/snowflakes.png" class="imgRz" style="width: 600px">
<p>Then you will use a technique called domain fronting, which makes you seems connecting to a legit service like azure cloud or google cloud, but your actual connection goes to the broker.</p>
<img src="snowflake-migrate/domain-fronting.png" class="imgRz" style="width: 600px">
<p>Then the broker server introduce you to the snowflake proxy, then you establish a webrtc connection, which is a connection allows two app to have direct connection for video call or file transmission. Then your traffic goes to the snowflake proxy, and connects to the rest of tor network</p>
<img src="snowflake-migrate/WebRTC.png" class="imgRz" style="width: 600px">
<p>Then you connect to tor network!</p>
<h2><b>Snowflake bridge in practice</b></h2> </br> </br>
<p>Now in practice, all you need to do to run a snowflake bridge is to have a webpage that runs the following HTML code:</p>
<iframe src="https://snowflake.torproject.org/embed.html" width="320" height="240" frameborder="0" scrolling="no"></iframe>
<p>Whoever wants to run a snowflake bridge simply has to click the "enabled" slider to run a snowflake bridge. Or you can also run <a href="https://addons.mozilla.org/en-US/firefox/addon/torproject-snowflake/">the snowflake firefox extension</a> to run a snowflake bridge whenever you are starting a webpage:</p>
<img src="15.png" class="imgRz">
<img src="16.png" class="imgRz">
<img src="17.png" class="imgRz">
<img src="18.png" class="imgRz">
<img src="19.png" class="imgRz">
<p> and then you can simply wait for someone to use it. Someone that needs to evade censorship somewhere in the world will start to use it when torproject will give them the snowflake bridgelike so: </p>
<img src="12.png" class="imgRz">
<img src="13.png" class="imgRz">
<img src="14.png" class="imgRz">
<p>If you want to use the snowflake bridge from torrc you can do as follows:</p>
<pre><code class="nim">
nihilist@mainpc: ~$ vim /etc/tor/torrc
nihilist@mainpc: ~$ cat /etc/tor/torrc
UseBridges 1
ClientTransportPlugin snowflake exec ./client -log snowflake.log
Bridge snowflake 192.0.2.3:80 2B280B23E1107BB62ABFC40DDCC8824814F80A72 fingerprint=2B280B23E1107BB62ABFC40DDCC8824814F80A72 url=https://snowflake-broker.torproject.net.global.prod.fastly.net/ fronts=foursquare.com,github.githubassets.com ice=stun:stun.l.google.com:19302,stun:stun.antisip.com:3478,stun:stun.bluesip.net:3478,stun:stun.dus.net:3478,stun:stun.epygi.com:3478,stun:stun.sonetel.com:3478,stun:stun.uls.co.za:3478,stun:stun.voipgate.com:3478,stun:stun.voys.nl:3478 utls-imitate=hellorandomizedalpn
Bridge snowflake 192.0.2.4:80 8838024498816A039FCBBAB14E6F40A0843051FA fingerprint=8838024498816A039FCBBAB14E6F40A0843051FA url=https://1098762253.rsc.cdn77.org/ fronts=www.cdn77.com,www.phpmyadmin.net ice=stun:stun.l.google.com:19302,stun:stun.antisip.com:3478,stun:stun.bluesip.net:3478,stun:stun.dus.net:3478,stun:stun.epygi.com:3478,stun:stun.sonetel.net:3478,stun:stun.uls.co.za:3478,stun:stun.voipgate.com:3478,stun:stun.voys.nl:3478 utls-imitate=hellorandomizedalpn
Bridge snowflake 192.0.2.3:80 2B280B23E1107BB62ABFC40DDCC8824814F80A72 fingerprint=2B280B23E1107BB62ABFC40DDCC8824814F80A72 url=https://1098762253.rsc.cdn77.org/ fronts=www.cdn77.com,www.phpmyadmin.net ice=stun:stun.l.google.com:19302,stun:stun.antisip.com:3478,stun:stun.bluesip.net:3478,stun:stun.dus.net:3478,stun:stun.epygi.com:3478,stun:stun.sonetel.com:3478,stun:stun.uls.co.za:3478,stun:stun.voipgate.com:3478,stun:stun.voys.nl:3478 utls-imitate=hellorandomizedalpn
nihilist@mainpc: ~$ systemctl restart tor@default
</pre></code>
</div>
</div><!-- /row -->
</div> <!-- /container -->
</div><!-- /white -->
<!-- +++++ Footer Section +++++ -->
<div id="anonb">
<div class="container">
<div class="row">
<div class="col-lg-4">
<h4>Nihilism</h4>
<p>
Until there is Nothing left.</p><p><a href="../../../../opsec/legal.html">Legal Disclaimer</a></p><p>Creative Commons Zero: No Rights Reserved</br><img src="\CC0.png">
</p>
</div><!-- /col-lg-4 -->
<div class="col-lg-4">
<h4>My Links</h4>
<p>
<a target="_blank" rel="noopener noreferrer" href="http://blog.nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/rss/feed.xml">RSS Feed</a><br/><a target="_blank" rel="noopener noreferrer" href="http://nowherejezfoltodf4jiyl6r56jnzintap5vyjlia7fkirfsnfizflqd.onion/simplex.html">SimpleX Chatrooms</a><br/>
</p>
</div><!-- /col-lg-4 -->
<div class="col-lg-4">
<h4>About nihilist</h4>
<p style="word-wrap: break-word;"><u>Donate XMR:</u> 8AUYjhQeG3D5aodJDtqG499N5jXXM71gYKD8LgSsFB9BUV1o7muLv3DXHoydRTK4SZaaUBq4EAUqpZHLrX2VZLH71Jrd9k8</p></br>
</div><!-- /col-lg-4 -->
</div>
</div>
</div>
<!-- Bootstrap core JavaScript
================================================== -->
<!-- Placed at the end of the document so the pages load faster -->
</body>
</html>
Reference in a new issue View git blame Copy permalink