Hi all,
Is anyone running Tor relay in k8s cluster? I am trying for a few days but It does not come alive. My servers are not behind a firewall, should be and are accessible, I run two bare-metal servers in Contabo. 1 master 1 node.
Docker image and helm chart that use; https://gitlab.com/nikoloskid/tor-server The logs I get;
Aug 05 21:04:55.000 [notice] Now checking whether IPv4 ORPort 38.242.233.101:32150 is reachable... (this may take up to 20 minutes -- look for log messages indicating success) Aug 05 21:24:45.000 [warn] Your server has not managed to confirm reachability for its ORPort(s) at 38.242.233.101:32150. Relays do not publish descriptors until their ORPort and DirPort are reachable. Please check your firewalls, ports
, address, /etc/hosts file, etc.
When i try telnet it is open to the internet
telnet 38.242.233.101 32150 Trying 38.242.233.101... Connected to 38.242.233.101. Escape character is '^]'.
You can see the service here; https://gitlab.com/nikoloskid/tor-server/-/raw/helm-chart-tor-relay/tor-serv...
/etc/tor/torrc;
Nickname icebergk8s Address 38.242.233.101 ContactInfo nikoloskid@pm.me RelayBandwidthRate 3.5MB RelayBandwidthBurst 5MB MaxAdvertisedBandwidth 5MB ORPort 9001 NoAdvertise IPv4Only ORPort 32150 NoListen IPv4Only SocksPort 0 ExitPolicy reject *:* User debian-tor DataDirectory /var/lib/tor
Lep pozdrav / Best Regards,
Daniel Nikoloski
Daniel Nikoloski
Hi Daniel
Not sure if that already has been answered. I don't use Kubernetes cluster but I find this one interesting:
Address 38.242.233.101 ORPort 9001 NoAdvertise IPv4Only ORPort 32150 NoListen IPv4Only
I believe the Tor server service will publish port 32150 but it listens to port 9001. It will not listen to where foreign Tor clients speak. Simply "ORPort 9001" could be enough if you bind Tor to the published address 38.242.233.101.
Unrelated:
If you will bind the Tor server service to an internal address (10.x.x.x) ie for use in a container, NoAdvertise and NoListen can be used to explain it to Tor:
Address 38.242.233.101 ORPort 10.x.x.x:9001 NoAdvertise IPv4Only ORPort 38.242.233.101:32150 NoListen IPv4Only
The firewall needs to forward the traffic from the external to the internal addresses. In pf world: rdr on $IFEXT inet proto tcp from any to 38.242.233.101 port 32150 -> 10.x.x.x port 9001
Finally (in my setup) the outbound traffic needs nat. In pf world: nat on $IFEXT inet from 10.x.x.x to any -> 38.242.233.101
tor-relays@lists.torproject.org
-
Daniel Nikoloski -
Felix