Proxy for Tor bridge

[hack3rcon]

Hello,
How can I put a Tor bridge behind a proxy, so that it is not directly connected to the Internet? Something like a reverse proxy that is used for websites.

Thank you.

[hack3rcon]

Hello,
Should I use port forwarding technique?

Thank you.

[WofWca]

Is this an attempt to achieve this?:

How to set the username and password to use Tor?

Hello, If someone has the IP address and port of my Tor server, they can connect to it and get services. How can I authenticate it? Thank you.

@hack3rcon

so that it is not directly connected to the Internet?

By this you mean that it’s not reachable from the outside, or that the Tor bridge itself cannot initiate outgoing connections? If it’s the former, then there are two ways:

• just ensure that your firewall blocks incoming connections to the bridge’s port (ORPort, ServerTransportListenAddr), and set up a reverse proxy on an open port.
• Set up listen address of the bridge to be localhost (I think the params are ORPort and ServerTransportListenAddr, although you probably won’t need obfuscation anyway in this case, and set up a reverse proxy on an open port.

Related: man tor: ORPort: NoListen and NoAdvertise flags, and BridgeDistribution none.

Is this what you’re asking?

[hack3rcon]

Hello,
Not really.
I mean the following plan:

Tor Server (Proxy or Bridge) ---> Proxy ---> Internet

How to setup a reverse proxy for an open port?

[capole]

To be honest I wonder if that would be possible by setting up Nginx Proxy Manager or Traefik. Maybe it is possible by setting up a configuration with NoAdvertise and NoListen?

That would be a cool little project to try, ngl. I don’t really see any benefit from doing that other than learning how it would work, though.

[WofWca]

@hack3rcon

I mean the following plan:

Tor Server (Proxy or Bridge) ---> Proxy ---> Internet

Then I think you got to use Socks5Proxy:

How to set the username and password to use Tor?

Socks5Proxy host[:port] Tor will make all OR connections through the SOCKS 5 proxy at host:port (or host:1080 if port is not specified). Socks5ProxyUsername username Socks5ProxyPassword password If defined, authenticate to the SOCKS 5 server using username and password in accordance to RFC 1929. Both username and password must be between 1 and 255 characters. These are used, when your Tor needs to connect through a proxy to reach the internet - not for Tor to provide a SOCKS-proxy.

Is it still not it? I don’t understand why you call it a reverse proxy. Isn’t it a regular proxy?

[esev]

There are two conflicting things here:

1. The direction of the arrows indicates a connection is being made from a Tor Server to the internet. In that case this would be a forward proxy.
2. The words “reverse proxy” and “open port” indicate that a connection is coming from the internet and going to the Tor Server.

Could you clarify a bit more?

[esev]

@capole

To be honest I wonder if that would be possible by setting up Nginx Proxy Manager or Traefik.

This would be a perfect scenario for a WebTunnel bridge. I am running one of these with Traefik today. I use a higher-priority Traefik router rule for the WebTunnel path. If someone visits www.domain.tld they get the normal website. If Tor visits www.domain.tld/TOR_WEBTUNNEL_PATH it connects to the bridge.

I have tested, and this also works with CF tunnels.

  nginx:
    image: nginx
    labels:
      - traefik.enable=true
      - traefik.http.routers.nginx.entrypoints=https-443
      - traefik.http.routers.nginx.rule=Host(`www.${DOMAIN}`)
      - traefik.http.services.nginx.loadbalancer.server.port=80
    volumes:
      - /archive/www/private:/usr/share/nginx/html:ro
    restart: unless-stopped
    networks:
      frontend:

  tor:
    image: thetorproject/webtunnel-bridge:latest
    entrypoint: ["/usr/sbin/tor", "-f", "/etc/tor/torrc"]
    security_opt:
      - apparmor=docker-tor
    mem_limit: 512m
    memswap_limit: 512m
    labels:
      - traefik.enable=true
      - traefik.http.routers.tor-webtunnel.entrypoints=https-443
      - traefik.http.routers.tor-webtunnel.rule=Host(`www.${DOMAIN}`) && PathPrefix(`/${TOR_WEBTUNNEL_PATH}`)
      - traefik.http.routers.tor-webtunnel.priority=999
      - traefik.http.services.tor-webtunnel.loadbalancer.server.port=8080
    volumes:
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
      - ${DEV_PATH}/tor/torrc:/etc/tor/torrc:ro
      - ${CONFIG_PATH}/tor:/var/lib/tor
    restart: unless-stopped
    networks:
      tor:

[hack3rcon]

Hello,
Thank you so much for your reply.
1- When you set up a Tor bridge, then connections from the Internet come to the Tor server. Isn’t it?

2- I just want to hide my Tor server behind another server. Instead of connecting directly to the Tor bridge server, clients connect to another server that sends clients’ requests to the main Tor server.

[hack3rcon]

Hello,
I mean the following plan:

Tor Server (Proxy or Bridge) ---> Proxy ---> Internet

Can using HTTPSProxy host[:port] statement in the Tor bridge configuration solve the problem?

[hack3rcon]

Hello,
Thank you so much for your reply.
I’m sorry if I couldn’t express my meaning correctly. I want to put the Tor server behind another server to increase its security. It means that the Tor server should not be directly connected to the Internet.

Tor Server (Proxy or Bridge) ---> Intermediate Server ---> Internet

How should the settings of this intermediate server be? Clients must connect to this intermediate server to use Tor.

[boldsuck]

@hack3rcon

Tor Server (Proxy or Bridge) ---> Intermediate Server ---> Internet

I can’t follow that. A typical tor cirquit with a Tor bridge is constructed like this to reach a page on the clearnet. Hidden services in the Tor network not considered.
(The connection is encrypted from the browser to the exit)

Tor Browser<->OBFS4 Proxy<->OBFS4 Proxy<->Tor Bridge<->Tor Middle Router<->Tor Exit Router<->Internet

[hack3rcon]

Hello,
Thanks again.
Why does this Intermediate Server make the Tor not work properly? Tor is not only directly connected to the Internet. Something like an http proxy (** TinyProxy**).

[WofWca]

Are you sure that my first reply is not what you want?

@hack3rcon

How to setup a reverse proxy for an open port?

I might have used the wrong term here? Not sure.
You can set up sshd on the server, then connect to it from your PC with ssh -L any_local_port:localhost:tor_bridge_port. This way, connections to localport on your local machine will be forwarded to torport of the server.

If it’s still not it, I think you need to better explain how threats that you are to protect yourself from would work, and how exactly you would use your setup.

[hack3rcon]

Hello,
Thanks again.
I want my Tor Proxy Server or Tor Bridge not directly accessing the Internet, but connecting to another server and getting the internet there. When you launch an Apache reverse proxy server, then you hide your real Apache web server behind another server. I want to do the same with the Tor. How should this Intermediate server be configured? Should I install the TinyProxy or Squid-cache on it, then use the HTTPProxy host[:port] statement in the Tor configuration to use the internet of that intermediate server?

[boldsuck]

@hack3rcon

I want my Tor Proxy Server or Tor Bridge not directly accessing the Internet,

That doesn’t make any sense at all. A Tor bridge must be accessible from the Internet, otherwise it won’t work. Outgoing traffic is not filtered on relays anyway. You have the option to configure a private hidden bridge and only give the bridgeline to certain people.

A Tor proxy (or several) runs on your localhost or on a device (gateway-Router, raspberry) for network-wide access and TorBrowser, $client-software connect to it.

I think you’re looking for ‘How to setup Tor as transparent proxy for my network’
Have you ever looked at all the config options in man torrc especially SocksPort & TransPort?

[hack3rcon]

Hello,
Thanks again.
My Tor proxy configuration is:

SocksPort 172.21.50.61:9050
SocksPolicy accept 172.21.50.0/25
RunAsDaemon 1
DataDirectory /var/lib/tor

Clients connect to my server’s IP address and receive service. I have placed this server behind an HTTP server. what’s wrong?