[tor-relays] Re: Hetzner Netscan False Positives

[Ralph Seichter via tor-relays <tor-relays@xxxxxxxxxxxxxxxxxxxx>]

* Tor at 1AEO via tor-relays:

> A few clarifications, grounded in Tor Project guidance: [...]
>
> - Tor’s community resources note that relay operators should “try to
> avoid the following hosters,” listing Hetzner, based on documented
> operational friction reported by relay operators
> https://community.torproject.org/relay/community-resources/good-bad-isps/

That's misleading at best. The reason Hetzner is named as one of a few
ISPs to possibly avoid, and which you chose not to quote, is this:

  For network diversity and stronger anonymity, you should avoid
  providers and countries that already attract a lot of Tor capacity.
  [...] These hosts already have many Tor nodes being hosted there.

I have hosted Tor relays on Hetzner for many years, am still doing so
now, and I did not experience "operational friction". On the contrary.
Hetzner are in fact Tor-friendly. Even their legal department told me
that running Tor nodes is fine as long as they don't negatively impact
Hetzner's infrastructure.

The main problem is that >100 IPv4 addresses in *your* single /24 network
have been unreachable several times during 2025. Hetzner's automated
tools interpret connection attempts to so many hosts in a /24 in a short
timeframe (originating from a given Hetzner based Tor node) as a possible
network scan, which is fair enough. That's just erring on the side of
caution, and they are notifying their own customers of a non-standard
traffic pattern.

I am positive that if you split your nodes across a more varied IPv4
address space, false alerts could be mitigated. I do appreciate what you
do for the Tor network, but please don't attempt to throw shade on
Hetzner. They are simply trying to run a responsible hosting business.

-Ralph
_______________________________________________
tor-relays mailing list -- tor-relays@xxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to tor-relays-leave@xxxxxxxxxxxxxxxxxxxx