Tor proxy server and bridge at the same time

Support
, ,
1

Hello,
I have three questions:

1- A Tor server that is used as a proxy server, can it be used as a Tor bridge at the same time?

2- If the server is in the internal network of an organization and has two NICs, one NIC with a private IP address and the other NIC with a public IP address. Is it possible for users inside the organization to connect to the NIC with a private IP address and use it as a proxy, and users outside the organization to connect to the NIC with a public IP address and use it as a bridge? Is it enough to use the private IP address in the proxy settings and the public IP address in the bridge settings?

3- Is it possible to do this with one NIC? Set the public IP address as the second IP address on the NIC.

Please answer my questions by number.

Thank you.

2

I am no expert on running tor relays/bridges and you should only follow a more experienced user advice on this, but as of my understanding:

  1. Yes, but not as in the same user/configuration. You’d have to create different users and run different torrc configurations (and ports), also, you may have to configure MyFamily. Running two relays operated by you needs MyFamily to be configured, so users don’t use your nodes twice, just once per chain connection. Is this really necessary if it’s a relay and a bridge? Since bridges are only used to circumvent censorship. I don’t know about this.

  2. No, I don’t think this is possible. Furthermore, doing so may be a security risk for those who want to use the Tor network privately inside your organisation.

  3. Assigning two different IP to a single NIC is actually possible, by doing something called IP aliasing, this is broadly used to host multiple websites. But for this to work properly you have to have in mind some considerations, as combined traffic for both IP is going to be handled by the same resources, so make sure you have plenty. You may want to configure different firewall policies for each IP, this can be somewhat hard, as a mistake can cause connectivity problems and so on.

1 Like
3

Hello,
Thank you so much for your reply.

1- What is MyFamily ?

2- Why not? In the torrc file, I use private IP address for proxy settings and public IP address for bridge settings. What is the problem with this?
What kind of security risk? I only leave the Tor ports open.

3- So, it is better to assign a separate network card for each service?

4

There’s another question about MyFamily on the forum, sometimes your doubts are already solved, look for those first.

  1. If you read the torrc config file you’ll see that there’s the option to set up MyFamily, this is a security setting. Let’s say you are running 3 different relays, in order to protect privacy you’ll have to configure it. This will tell tor which relays are yours, so next time a user builds a circuit in order to navigate with the tor browser, there is no chance that the circuit will be composed by more than one of your relays. This way, you’ll participate on the user’s circuit with just one of your relays, and not more. If the same user controls more than one relay in the circuit, de-anonymization can occur.

You can read the FAQ dedicated for relay operators here.
If you are interested in running more than a relay inside the same network, read this.

Also, according to torrc about MyFamily, do NOT include your bridge inside your relay’s family.

However, you should never include a bridge’s fingerprint here, as it would break its concealability and potentionally reveal its IP/TCP address.

  1. The security risk is not for the server, but for your clients using the bridge. I just don’t really see the point on creating a private bridge, maybe someone with more knowledge on this can get us out of doubt.

  2. Not really, this depends on your needs. When I say they will use the same resources it’s not just the NIC capacity to handle traffic load but also CPU and RAM to proccess all of that.

1 Like
5

Hello,
Thank you so much again.
1- I just use the Tor as a proxy server. Is this considered a node?

2- You said “You’d have to create different users and run different torrc configurations (and ports),…”, do you mean the login name?

3- How can I run the different torrc file? With every username that I log in to the system, there is only one torrc file!!!

6

Here is a way of achieving what you want. Remember, looking around in the forum is your best friend. You are probably not the first person to have the same problem or doubt, the project has been running for many years now :wink:

https://manpages.debian.org/bullseye/tor/tor-instance-create.8.en.html

The tool tor-instance-create should already be installed on your system.
Many times it’s just a matter of trial and error. If it isn’t the exact same thing I told you, it’s probably something really similar.

1 Like
7

Little tutorial on how to set up a second tor daemon using the tool I just shared with you.

1 Like