[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #19064 [- Select a component]: Access denied, by most exits, to a very specific IP range
#19064: Access denied, by most exits, to a very specific IP range
----------------------------------+--------------------------
Reporter: Tu2020 | Owner:
Type: defect | Status: reopened
Priority: Medium | Milestone:
Component: - Select a component | Version:
Severity: Normal | Resolution:
Keywords: range IP block | Actual Points:
Parent ID: | Points:
Reviewer: | Sponsor:
----------------------------------+--------------------------
Comment (by teor):
Replying to [comment:3 Tu2020]:
> Replying to [comment:2 teor]:
> > It's likely that this IP range has decided to block Tor Exit nodes. If
so, there's nothing we can do. (Except ask politely to be unblocked.)
> >
> > Feel free to look up the owner of the IP range and add them to:
> >
https://trac.torproject.org/projects/tor/wiki/org/doc/ListOfServicesBlockingTor
>
> I have triple checked with the Administrator of the IP range, as well as
the Hosting company. Neither of those entities have blocked TOR exits.
In fact, it would be technically impossible to do so, because of the
quantity of addresses. These are the rationale given to me both both the
Administrator of the sites in that IP range, as well as the hosting
company (Hivelocity).
>
> Of course, I have reviewed
https://trac.torproject.org/projects/tor/wiki/org/doc/ListOfServicesBlockingTor
, and it is focused entirely about a server side block, which, as I've
specified, is not the case here.
>
> The blocking in question is distinctly from within TOR.
Each Tor Exit operator makes their own decisions about what ports and IP
ranges they will allow.
The top 10 exits on Compass do not block this range in their exit
policies:
https://compass.torproject.org/#?exit_filter=fast_exits_only_any_network&links&sort=cw&sort_reverse&country=
So there is no Tor block at the Exit level.
(And Tor has no way to configure blocks at the Tor Network level.)
When I tried to connect to 162.216.5.226 in Tor Browser, I received the
typical log entries that happen when an IP range drops packets from Tor
Exits:
{{{
May 16 06:21:55.000 [notice] We tried for 15 seconds to connect to
'[scrubbed]' using exit
$20B0038D7A2FD73C696922551B8344CB0893D1F8~edwardsnowden1 at 109.163.234.8.
Retrying on a new circuit.
May 16 06:22:11.000 [notice] We tried for 15 seconds to connect to
'[scrubbed]' using exit
$7D5CCD1D8D798779979DF7E0A3A2BFA55D2C24B3~torlesnet2 at 199.87.154.251.
Retrying on a new circuit.
May 16 06:22:27.000 [notice] We tried for 15 seconds to connect to
'[scrubbed]' using exit
$4B170476D09459328438F3E68ED19516C9F75A80~birnenpfeffimitzimt at
212.21.66.6. Retrying on a new circuit.
May 16 06:22:42.000 [notice] We tried for 15 seconds to connect to
'[scrubbed]' using exit $379FB450010D17078B3766C2273303C358C3A442~aurora
at 176.126.252.12. Retrying on a new circuit.
May 16 06:22:57.000 [notice] We tried for 15 seconds to connect to
'[scrubbed]' using exit $615ABEA2DE76EB3760BC51E7306BAA59F15CD8F2~Cloud at
5.135.158.101. Retrying on a new circuit.
May 16 06:23:14.000 [notice] We tried for 15 seconds to connect to
'[scrubbed]' using exit $9D6AE1BD4FDF39721CE908966E79E16F9BFCCF2F~Necto at
93.115.95.201. Retrying on a new circuit.
May 16 06:23:29.000 [notice] We tried for 15 seconds to connect to
'[scrubbed]' using exit
$69DF3CDA1CDA460C17ECAD9D6F0C117A42384FA0~AccessNow008 at 176.10.99.204.
Retrying on a new circuit.
May 16 06:23:29.000 [notice] Tried for 132 seconds to get a connection to
[scrubbed]:80. Giving up.
}}}
It's possible Hivelocity has a block at the network (/28 or higher) level
that targets unwanted traffic, and Tor Exits are included in that block.
The administrators you contacted could be unaware of this block, or may
not understand the consequences of the traffic filtering that has been
configured.
This could well be part of Hivelocity's "DDoS protection" or "Firewall"
services:
https://www.hivelocity.net/enhancements/ddos-protection/
https://www.hivelocity.net/enhancements/firewall/
And yes, it is possible to block almost all Tor Exits from accessing an
entire network. All it takes is one device at the entry to the network,
configured with a list of Tor Exits.
Please feel free to provide logs or packet traces that show where
connections to 162.216.5.226 are being blocked - as you can see from the
above logs and Compass exit list, there is no blocking between Tor clients
and Tor exits, or in Tor exit policies.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/19064#comment:4>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs