# Docker standalone snowflake stuck on "proxy starting"
**URL:** https://forum.torproject.org/t/docker-standalone-snowflake-stuck-on-proxy-starting/16750
**Category:** Relay Operator
**Tags:** snowflake
**Created:** [January 9, 2025, 10:28am UTC](https://forum.torproject.org/t/docker-standalone-snowflake-stuck-on-proxy-starting/16750 "2025-01-09T10:28:33Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@yummy\_onion](https://forum.torproject.org/u/yummy_onion)
#### Post date: [January 9, 2025, 10:28am UTC](https://forum.torproject.org/t/docker-standalone-snowflake-stuck-on-proxy-starting/16750/1 "2025-01-09T10:28:33Z")
I have set up Docker in Fedora and the standalone snowflake on it. When I check the snowflake’s status, it just says “proxy starting, NAT type: restricted.” I have a few questions:
1. How come my proxy doesn’t start?
2. The network layout is modem \> ISP router \> hardware firewall \> personal router. Would changing my personal router or firewall’s NAT to unrestricted suffice or does the router above it (the ISP router) need to have the NAT unrestricted?
3. What would be the easiest way to set the NAT to unrestricted? And should I do it on the firewall or personal router?
---
### Author:  [@Vort](https://forum.torproject.org/u/Vort)
#### Post date: [January 9, 2025, 4:49pm UTC](https://forum.torproject.org/t/docker-standalone-snowflake-stuck-on-proxy-starting/16750/2 "2025-01-09T16:49:05Z")
> [@yummy\_onion](#):
>
> How come my proxy doesn’t start?
It may be logging problem. Try waiting for 1 hour and look if there will be additional messages in log.
> [@yummy\_onion](#):
>
> - The network layout is modem \> ISP router \> hardware firewall \> personal router. Would changing my personal router or firewall’s NAT to unrestricted suffice or does the router above it (the ISP router) need to have the NAT unrestricted?
> - What would be the easiest way to set the NAT to unrestricted? And should I do it on the firewall or personal router?
For `unrestricted` mode, your computer should be able to accept incoming connections.
It means you need either public IP (there should be no NATs at all), or your NAT(s) should be configured to forward (map) some ports to your computer. In case of port mapping, additional command line options will need to be passed to snowflake _(I did not tried it myself, but it should be explained in documentation somewhere)_.
---
### Author:  [@zerologs](https://forum.torproject.org/u/zerologs)
#### Post date: [January 9, 2025, 5:29pm UTC](https://forum.torproject.org/t/docker-standalone-snowflake-stuck-on-proxy-starting/16750/3 "2025-01-09T17:29:55Z")
You mentioned you wish to become NAT unrestricted. The other members told the snowflake proxy does work with restricted NAT and it does work no problem but you will only have small connected clients. But if you still want to pursue then go for it. If you have time may I suggest you check out my post.
Especially the part with the NAT behaviour discovery using STUN
[https://forum.torproject.org/t/standalone-snowflake-nat-type-problem/16246/6](https://forum.torproject.org/t/standalone-snowflake-nat-type-problem/16246/6)
Hope this helps and just reply back if you’re still stuck… let’s make that snowflake BURN! 😃
---
### Author:  [@WofWca](https://forum.torproject.org/u/WofWca)
#### Post date: [January 9, 2025, 8:21pm UTC](https://forum.torproject.org/t/docker-standalone-snowflake-stuck-on-proxy-starting/16750/4 "2025-01-09T20:21:37Z")
> [@yummy\_onion](#):
>
> 1. How come my proxy doesn’t start?
How do you know it doesn’t start? Just based on the log messages? It’s the expected output. Your proxy is working. If you want more messages, pass in `-verbose`.
> [@yummy\_onion](#):
>
> 1. Would changing my personal router or firewall’s NAT to unrestricted suffice or does the router above it (the ISP router) need to have the NAT unrestricted?
The latter. All routers in the way need to have an unrestricted NAT.
> [@yummy\_onion](#):
>
> What would be the easiest way to set the NAT to unrestricted? And should I do it on the firewall or personal router?
The easiest way is to set up port forwarding. See [How to set up standalone snowflake behind restrictive NAT? - #2 by WofWca](https://forum.torproject.org/t/how-to-set-up-standalone-snowflake-behind-restrictive-nat/16693/2). About the firewall: I’m not sure.
---
### Author:  [@yummy\_onion](https://forum.torproject.org/u/yummy_onion)
#### Post date: [January 10, 2025, 7:20pm UTC](https://forum.torproject.org/t/docker-standalone-snowflake-stuck-on-proxy-starting/16750/5 "2025-01-10T19:20:44Z")
Thanks for sharing, I got the standalone snowflake up and running but in my search for unrestricted NAT I read that my ISP implements carrier-grade NAT and doesn’t offer opt out to residential customers. Wouldn’t this prevent me from setting up unrestricted NAT?
---
### Author:  [@yummy\_onion](https://forum.torproject.org/u/yummy_onion)
#### Post date: [January 10, 2025, 7:21pm UTC](https://forum.torproject.org/t/docker-standalone-snowflake-stuck-on-proxy-starting/16750/6 "2025-01-10T19:21:31Z")
> [@WofWca](#):
>
> If you want more messages, pass in `-verbose`.
The command `docker logs -f snowflake-proxy -v` returned the error `unknown shorthand flag: 'v' in -v See 'docker logs --help'.`
> [@WofWca](#):
>
> All routers in the way need to have an unrestricted NAT.
What if my ISP enforces carrier-grade NAT and doesn’t allow opting out, would I still have a way of having unrestricted NAT? If so, how much additional security risk would it be to implement this method of unrestricted NAT?
---
### Author:  [@WofWca](https://forum.torproject.org/u/WofWca)
#### Post date: [January 11, 2025, 1:48pm UTC](https://forum.torproject.org/t/docker-standalone-snowflake-stuck-on-proxy-starting/16750/7 "2025-01-11T13:48:38Z")
> [@yummy\_onion](#):
>
> my ISP implements carrier-grade NAT and doesn’t offer opt out to residential customers. Wouldn’t this prevent me from setting up unrestricted NAT?
Depends on the NAT type.
> [@yummy\_onion](#):
>
> The command `docker logs -f snowflake-proxy -v` returned the error `unknown shorthand flag: 'v' in -v See 'docker logs --help'.`
`-verbose` is a Snowflake CLI argument, not a Docker argument.
> [@yummy\_onion](#):
>
> If so, how much additional security risk would it be to implement this method of unrestricted NAT?
Not much of a risk IMO. As you can see, Snowflake _expects_ that NAT is unrestricted, so having unrestricted NAT is normal.
---
### Author:  [@zerologs](https://forum.torproject.org/u/zerologs)
#### Post date: [January 11, 2025, 1:48pm UTC](https://forum.torproject.org/t/docker-standalone-snowflake-stuck-on-proxy-starting/16750/8 "2025-01-11T13:48:56Z")
Yes Carrier Grade NAT will restrict you, but the snowflake proxy will still work.
---
### Author:  [@system](https://forum.torproject.org/u/system)
#### Post date: [January 12, 2025, 1:49pm UTC](https://forum.torproject.org/t/docker-standalone-snowflake-stuck-on-proxy-starting/16750/9 "2025-01-12T13:49:08Z")
This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.