Realities of hosting a tor relay node at home
-
https://snowflake.torproject.org/
I feel like I should mention the Snowflake browser plug-in, which to my understanding, creates a relay in your browser basically.
It can also be run as a standalone background service, so you don't have to have a browser window open all the time. I've run one for years. Super easy.
-
I am in the EU. I want to help make the TOR network more robust by contributing a relay node. I have one of three hardware options: a raspberry pi zero W, raspberry pi 4B, or ThinkPad T470s.
In your practical experience, which of these computers would be the best for the network? As I understand, beyond a point, the CPU power doesn't matter unless massive traffic loads go through the node.
P.S: Not sure if this is relevant, but I currently have a pihole hosted in a separate RPI zero. I plan to host this at home. I do not have a separate connection line. My router doesn't support vlan.
Add: Thank you for the kind replies. Based on the feedback, it think I'm currently not setup to help the network. I will instead continue with my annual contribution.
I will look into hosting a node on a VPS and just pay a monthly subscription fee or something.
wrote on last edited by [email protected]Host a middle node
Keep in mind that none of the hardware you listed is great for hosting. It could work but I would go for somethinga little more modern. Something like a i5-7500 would be great. Get a router with vlans since you probably will want to segment the network.
For networking make sure you have a solid low latency reasonable bandwidth connection. I would do gigabit fiber since that will provide a decent amount of bandwidth while having low latency.
Also you could look into running a i2p node on the same machine since they both need volunteers.
-
I have tried hosting a Tor relay on a VPS in the past and it was bottlenecked by the CPU at barely 20MB/s, although to be fair this was without hardware AES. More importantly for you, the server's IP started getting DDoSed constantly and a whole bunch of big internet services just immediately blocked the address (the list of relay IPs is public and many things just block every address on that list instead of only exit nodes). So any of your machines are probably at least somewhat up to the task (ideally if they have hardware AES support), but this is definitely not something I'd do on my home network.
wrote on last edited by [email protected]Were you using ancient hardware or something? More modern CPUs shouldn't have this issue.
Also middle nodes shouldn't be getting ddosed.
-
I am in the EU. I want to help make the TOR network more robust by contributing a relay node. I have one of three hardware options: a raspberry pi zero W, raspberry pi 4B, or ThinkPad T470s.
In your practical experience, which of these computers would be the best for the network? As I understand, beyond a point, the CPU power doesn't matter unless massive traffic loads go through the node.
P.S: Not sure if this is relevant, but I currently have a pihole hosted in a separate RPI zero. I plan to host this at home. I do not have a separate connection line. My router doesn't support vlan.
Add: Thank you for the kind replies. Based on the feedback, it think I'm currently not setup to help the network. I will instead continue with my annual contribution.
I will look into hosting a node on a VPS and just pay a monthly subscription fee or something.
For the Tor operators, how to you mitigate the risks associated with what's being trafficked across your network?
-
I am in the EU. I want to help make the TOR network more robust by contributing a relay node. I have one of three hardware options: a raspberry pi zero W, raspberry pi 4B, or ThinkPad T470s.
In your practical experience, which of these computers would be the best for the network? As I understand, beyond a point, the CPU power doesn't matter unless massive traffic loads go through the node.
P.S: Not sure if this is relevant, but I currently have a pihole hosted in a separate RPI zero. I plan to host this at home. I do not have a separate connection line. My router doesn't support vlan.
Add: Thank you for the kind replies. Based on the feedback, it think I'm currently not setup to help the network. I will instead continue with my annual contribution.
I will look into hosting a node on a VPS and just pay a monthly subscription fee or something.
Hey there are various ways to do it, but if you have a suitable bit of hardware I'd self host at home - just because!
Pi 4B would be better but you can quickly get loads of traffic so if you broadband isn't great it can slow things down! If you want to host a tor relay and self host other stuff there are means and ways to do that as well. I have run a tor relay before through yunohost for example -
Tor operator here.
If you don’t have a second IP for your relay, don’t host at home. You will have CAPTCHAs everywhere, many sites will block you and your ISP will eventually contact you to stop degrading their IP space reputation.
Most website owners don’t discriminate between Tor exits and relays. They subscribe to block-lists that include all known Tor IP addresses. Major online services will make your browsing experience really shitty and once you’re a “known Tor IP” it will take months to remove that reputation.
You can run a Bridge instead, but you will eventually have the same problem.
to be fair I really just used my relay for myself and didn't run into that many issues... but this IS the reality if you want to help others like you said...
-
I am in the EU. I want to help make the TOR network more robust by contributing a relay node. I have one of three hardware options: a raspberry pi zero W, raspberry pi 4B, or ThinkPad T470s.
In your practical experience, which of these computers would be the best for the network? As I understand, beyond a point, the CPU power doesn't matter unless massive traffic loads go through the node.
P.S: Not sure if this is relevant, but I currently have a pihole hosted in a separate RPI zero. I plan to host this at home. I do not have a separate connection line. My router doesn't support vlan.
Add: Thank you for the kind replies. Based on the feedback, it think I'm currently not setup to help the network. I will instead continue with my annual contribution.
I will look into hosting a node on a VPS and just pay a monthly subscription fee or something.
If you do end up hosting on a VPS, consider one with renewable energy since tor nodes can consume a lot of power over time - or for home setups, you could run it off a portable power station to offset electricity costs (check out power station comparisons to find the best wh value for continous loads).
-
For the Tor operators, how to you mitigate the risks associated with what's being trafficked across your network?
- simply don't run an exit node (from home)
- run you relay no mether the type of a cheap vps that's tor friendly
-
I ran a relay too way, way back in the day and I remember almost a third of the sites I used blacklisted my IP address within days. It wasn't cool.
I ended up shutting it down, resetting my cable modem, and spoofing a new MAC address on my router to get a new IP address to get everything working again.
Using a VPN is smarter. I wouldn't run that on IPv6 whatsoever.
Why not on IPv6? If you received a /64 from your ISP and pick only one IPv6 for Tor, I don't see what the issue would be...
-
Why not on IPv6? If you received a /64 from your ISP and pick only one IPv6 for Tor, I don't see what the issue would be...
wrote on last edited by [email protected]Personally, I think IPv6 is not a good choice for any service you don't want associated with a specific device. As I understand it, the prefix delegation comes from the ISP, but often the interface ID is derived from the machine's MAC address which is a link to specific machine hardware, can reveal information about the host, and possibly deanonymoized across networks.
I'd stick with IPv4 because NAT gives a tad more anonymity. Just my $0.02 though.
-
Personally, I think IPv6 is not a good choice for any service you don't want associated with a specific device. As I understand it, the prefix delegation comes from the ISP, but often the interface ID is derived from the machine's MAC address which is a link to specific machine hardware, can reveal information about the host, and possibly deanonymoized across networks.
I'd stick with IPv4 because NAT gives a tad more anonymity. Just my $0.02 though.
I understand your position better, indeed. Thanks for taking the time to explain!
You'll be happy to learn that what you describe, EUI-64, is not the only way to generate an IPv6 address. The router will give you the prefix in any case, but there is the Stable Privacy Addresses scheme if you want the link-local part generated automatically, and you can set up a static IPv6 address (or several) on your machine, and the router will just have to shut up and deal it to you (for the local part, the prefix is still coming from the ISP)
