Obfs4 IPv4: dysfunctional

Support Relay Operator
1 
Bridge xxxx advertises:

* obfs4 IPv4: dysfunctional
  Error: timed out waiting for bridge descriptor
  Last tested: 2024-09-18 14:13:33.780673824 +0000 UTC (1h38m37.419913121s ago)

user@raspberrypi:~ $ sudo journalctl -u tor -n 20
Sep 18 18:44:09 raspberrypi tor[1822]: Sep 18 18:44:09.000 [notice] Registered server transport 'obfs4' at '[::]:34567'
Sep 18 18:46:10 raspberrypi tor[1822]: Sep 18 18:46:10.000 [notice] Self-testing indicates your ORPort 79.114.246.22:23456 is reachable from the outside. Excellent. Publishing server descriptor.

user@raspberrypi:~ $ sudo cat /var/lib/tor/.tor/pt_state/obfs4_bridgeline.txt
Bridge obfs4 <IP ADDRESS>:<PORT> <FINGERPRINT> cert=xxxxxxxx iat-mode=0

Have tried in Tor to test the bridge
obfs4 xxxx:34567 xxxxx cert=xxxxx iat-mode=0
And the log in tor says

2024-09-18 15:45:04.308 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections.
2024-09-18 15:45:47.891 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections.
2024-09-18 15:45:47.911 [NOTICE] Opening Socks listener on 127.0.0.1:9150
2024-09-18 15:45:47.911 [NOTICE] Opened Socks listener connection (ready) on 127.0.0.1:9150
2024-09-18 15:45:48.345 [NOTICE] Bootstrapped 1% (conn_pt): Connecting to pluggable transport
2024-09-18 15:45:48.347 [NOTICE] Bootstrapped 2% (conn_done_pt): Connected to pluggable transport
2024-09-18 15:45:48.376 [WARN] Proxy Client: unable to connect OR connection (handshaking (proxy)) with xxxxxxxx:34567 ID=<none> RSA_ID=xxxxxxxx ("general SOCKS server failure")
2024-09-18 15:45:49.365 [WARN] Proxy Client: unable to connect OR connection (handshaking (proxy)) with xxxxxxxx:34567 ID=<none> RSA_ID=xxxxxxxx ("general SOCKS server failure")
2024-09-18 15:45:51.366 [WARN] Proxy Client: unable to connect OR connection (handshaking (proxy)) with xxxxxxxx:34567 ID=<none> RSA_ID=xxxxxxxx ("general SOCKS server failure")
2024-09-18 15:45:53.368 [NOTICE] Bootstrapped 10% (conn_done): Connected to a relay
2024-09-18 15:45:53.395 [NOTICE] Bootstrapped 14% (handshake): Handshaking with a relay
2024-09-18 15:45:53.447 [WARN] Tried connecting to router at xxxxxxxx:34567 ID=<none> RSA_ID=xxxxxxxx, but RSA + ed25519 identity keys were not as expected: wanted xxxxxxxx + no ed25519 key but got xxxxxxxx + tiaerH9nSTPwEdTKAeRqyCDUR9AN8h9Cskw1qASxzaw.
2024-09-18 15:45:53.447 [WARN] Problem bootstrapping. Stuck at 14% (handshake): Handshaking with a relay. (Unexpected identity in router certificate; IDENTITY; count 1; recommendation warn; host xxxxxxxx at xxxxxxxx:34567)
2024-09-18 15:45:53.447 [WARN] 3 connections have failed:
2024-09-18 15:45:53.447 [WARN] 3 connections died in state handshaking (proxy) with SSL state (No SSL object)
2024-09-18 15:45:53.451 [NOTICE] Closing no-longer-configured Socks listener on 127.0.0.1:9150
2024-09-18 15:45:53.451 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections.
2024-09-18 15:45:53.452 [WARN] Managed proxy "N/A" process terminated with status code 0

user@raspberrypi:~ $ sudo systemctl status tor
● tor.service - Anonymizing Overlay Network
     Loaded: loaded (/etc/systemd/system/tor.service; enabled; vendor preset: enabled)
     Active: active (running) since Wed 2024-09-18 18:43:20 EEST; 20min ago
   Main PID: 1822 (tor)
      Tasks: 16 (limit: 3933)
        CPU: 1min 25.468s
     CGroup: /system.slice/tor.service
             ├─1822 /usr/local/bin/tor -f /etc/tor/torrc
             └─1823 /usr/bin/obfs4proxy

user@raspberrypi:~ $ cat /etc/systemd/system/tor.service
[Unit]
Description=Anonymizing Overlay Network
After=network.target

[Service]
NoNewPrivileges=no
Type=simple
User=debian-tor
ExecStart=/usr/local/bin/tor -f /etc/tor/torrc
ExecReload=/bin/kill -HUP $MAINPID
KillSignal=SIGINT
TimeoutStopSec=30
Restart=on-failure

[Install]
WantedBy=multi-user.target

user@raspberrypi:~ $ telnet ip 34567
Trying ip...
Connected to ip.
Escape character is '^]'.

user@raspberrypi:~ $ ls -ld /usr/bin/obfs4proxy
-rwxr-xr-x 1 debian-tor root 5242752 Dec  2  2019 /usr/bin/obfs4proxy
user@raspberrypi:~ $ ls -ld /etc/tor/torrc
-rw-r--r-- 1 root root 1213 Sep 18 18:18 /etc/tor/torrc
user@raspberrypi:~ $ cat /etc/tor/torrc
BridgeRelay 1
ORPort 0.0.0.0:23456
ServerTransportPlugin obfs4 exec /usr/bin/obfs4proxy
ServerTransportListenAddr obfs4 0.0.0.0:34567
ExtORPort auto

Any idea what could be wrong?

2

https://community.torproject.org/relay/setup/bridge/debian-ubuntu/ (Section 5):

# Replace "TODO1" with a Tor port of your choice.
# This port must be externally reachable.
# Avoid port 9001 because it's commonly associated with Tor and censors may be scanning the Internet for this port.
ORPort TODO1

ServerTransportPlugin obfs4 exec /usr/bin/obfs4proxy

# Replace "TODO2" with an obfs4 port of your choice.
# This port must be externally reachable and must be different from the one specified for ORPort.
# Avoid port 9001 because it's commonly associated with Tor and censors may be scanning the Internet for this port.
ServerTransportListenAddr obfs4 0.0.0.0:TODO2

You have made both the TODO1 and the TODO2 port externally reachable?

3

Yes, I can telnet into both using my external IP.

user@raspberrypi:~ $ telnet IP 34567
Trying IP...
Connected to IP.
Escape character is '^]'.
^]

user@raspberrypi:~ $ telnet IP 23456
Trying IP...
Connected to IP.
Escape character is '^]'.
4

Well,
I do configure the OR port of public bridges with obfs4 in this way: tor-relays/playbooks/roles/setup_tor/templates/torrc.j2 at main · toralf/tor-relays · GitHub

6 
user@raspberrypi:~ $ sudo cat /etc/tor/torrc
BridgeRelay 1
ORPort 23456 IPv4Only
DataDirectory /var/lib/tor
ServerTransportPlugin obfs4 exec /usr/bin/obfs4proxy
ServerTransportListenAddr obfs4 0.0.0.0:34567
ExtORPort auto

This is my torrc, I have dynamic IP, I thought is the best config to use.

And I get

user@raspberrypi:~ $ sudo journalctl -u tor -f
[notice] External address seen and suggested by a directory authority: EXTERNAL_IP
[notice] Now checking whether IPv4 ORPort EXTERNAL_IP:23456 is reachable... (this may take up to 20 minutes -- look for log messages indicating success)
[notice] Self-testing indicates your ORPort EXTERNAL_IP:23456 is reachable from the outside. Excellent. Publishing server descriptor.

user@raspberrypi:~ $ telnet EXTERNAL_IP 34567
Trying EXTERNAL_IP...
Connected to EXTERNAL_IP.
Escape character is '^]'.

So both ports are reachable from outside.

7

I made Tor Browser connect to it, but I used identity key fingerprint, not the hashed one, and it worked, I somehow thought to connect it has to be the hashed one.

Is it fine if it works to connect but the status is still obfs4 IPv4: dysfunctional?
Or there is something more I can do?