Re: [tor-relays] snowflake vs bridges (vs node)

[Fran via tor-relays <tor-relays@xxxxxxxxxxxxxxxxxxxx>]

Thanks meskio, this helped a lot to clarify things.

So I thought of trying to run a bride and a snowflakeproxy on one VM 
with individual IP addressing in v4 and v6 for each by adding secondary 
addresses to to the WAN interface. But after compiling the go binary I 
fail to find out how to tell snowflake which IP to bind to/use.

For the bridge this can be achieved with:

Address  <IPv4>
Address  <IPv6>
OutboundBindAddress <IPv4>
OutboundBindAddress <IPv6>

(and maybe to be save also set OutboundBindAddressPT, 
OutboundBindAddressExit and OutboundBindAddressOR)

But for snowflake I'm missing the options:

Usage of ./proxy:
  -broker string
    	broker URL (default "https://snowflake-broker.torproject.net/";)
  -capacity uint
    	maximum concurrent clients
  -keep-local-addresses
    	keep local LAN address ICE candidates
  -log string
    	log filename
  -nat-retest-interval duration
    	the time interval in second before NAT type is retested, 0s 
disables retest. Valid time units are "s", "m", "h".  (default 24h0m0s)
  -relay string
    	websocket relay URL (default "wss://snowflake.bamsoftware.com/")
  -stun string
    	broker URL (default "stun:stun.stunprotocol.org:3478")
  -summary-interval duration
    	the time interval to output summary, 0s disables retest. Valid 
time units are "s", "m", "h".  (default 1h0m0s)
  -unsafe-logging
    	prevent logs from being scrubbed
  -verbose
    	increase log verbosity

Could be solved with VRFs/namespaces but would involve bridging, 
veths...too snowflaky for me (same goes for containers).

So I guess I'll just keep the bridges and make then relays one day.

Thanks for all who helped!

best
fran


On 2/7/22 11:12, meskio wrote
> Yes, there are many differencies. snowflake does make the traffic look like
> webrtc (like a video conference) and obfs4 makes the traffic look like random
> noise. Also the clients use different mechanisms to discover the relays.
>
> If you run both in the same IP address and the censor has a way to discover one
> but not the other both of them will be blocked at once. So you are making it
> easier for the censor to discover them and block them. That is why we don't want
> people to run both in the same IP address.
_______________________________________________
tor-relays mailing list
tor-relays@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays