[tor-relays] Maximizing contribution with own ASN + IPv6 — exit vs guard, IPv6 exit, AS diversity

Mailing Lists tor-relays
1

Hi all,

I run my own ASN and announce my own IPv6 prefix via BGP (with valid RPKI ROAs), plus IPv4. I’d like to contribute to the network in the way that adds the most value, and I’d appreciate guidance from experienced operators.

My situation:

  • ASN: own, prefix announced via BGP (IPv6 /48, IPv4 /28)
  • Bandwidth available: ~100 Mbit/s, monthly traffic budget: unmetered
  • Willing to handle abuse complaints: yes
  • rDNS and abuse contact fully under my control

My questions:

  1. Given that AS diversity is scarce, is an exit relay the highest-value use here, or does a high-bandwidth guard already help significantly from an underrepresented AS?
  2. IPv6 exit support seems uncommon — is enabling IPv6Exit on my exit a meaningful gap to fill, and any caveats?
  3. Any recommendations on exit policy and per-IP layout within my prefix to balance reachability and abuse handling?
  4. If I run multiple relays, is the new cryptographic family scheme (FamilyId / tor --keygen-family) the right approach over legacy MyFamily?

Happy to share more details. Thanks for any pointers.

2

- Given that AS diversity is scarce, is an exit relay the highest-value use here, or does a high-bandwidth guard already help significantly from an underrepresented AS?

Of course, as an exit relay can (but most likely will not) be used for non-exit, but a non-exit will never allow exit traffic.

- IPv6 exit support seems uncommon — is enabling IPv6Exit on my exit a meaningful gap to fill, and any caveats?

Yes, please do it.

···

Am 20.06.26 um 04:17 schrieb lists.torproject.org.broker091--- via tor-relays:

--
Gruß
Marco

Junk-Mail bitte an trashcan@stinkedores.dorfdsl.de
_______________________________________________
tor-relays mailing list -- tor-relays@lists.torproject.org
To unsubscribe send an email to tor-relays-leave@lists.torproject.org

3

Hello.

Given that AS diversity is scarce, is an exit relay the highest-value
use here, or does a high-bandwidth guard already help significantly
from an underrepresented AS?

An exit on an underrepresented AS with underrepresented upstreams is the
most valuable contribution, but a high-bandwidth non-exit is still very
useful. If you're looking for diversity, make sure to check bgp.tools to
see what upstreams are in use. A unique AS that's single-homed Cogent
isn't as valuable as a unique AS that has underrepresented upstreams.

IPv6 exit support seems uncommon — is enabling IPv6Exit on my exit a
meaningful gap to fill, and any caveats?

Yes! Supporting IPv6 is very useful! I think Tor is planning on one day
deprecating relays that are not dual stack, although I don't know how
soon that is. There are no caveats, as long as the IPv6 is working.

Any recommendations on exit policy and per-IP layout within my prefix
to balance reachability and abuse handling?

Be 100% sure your provider is on board. Even if you own the IP range and
you're the abuse contact, many providers won't want to announce a prefix
that puts them or their contract at a colo facility at risk.

As for exit policy, you can start with ReducedExitPolicy if you haven't
run an exit before. Verify with your provider, since sometimes they
might want you to disable 22, 465, and 587 which are enabled by default
even on ReducedExitPolicy.

If I run multiple relays, is the new cryptographic family scheme
(FamilyId / tor --keygen-family) the right approach over legacy
MyFamily?

For now, you have to use both. In the near future, the legacy scheme
will be deprecated and removed, but until then you still have to use it.

Regards,
forest

···

_______________________________________________
tor-relays mailing list -- tor-relays@lists.torproject.org
To unsubscribe send an email to tor-relays-leave@lists.torproject.org