Opened 8 years ago

Closed 8 years ago

#4164 closed defect (fixed)

Advertise port 443, but listen on 9001

Reported by: runa Owned by: runa
Priority: Medium Milestone:
Component: Archived/Tor Cloud Version:
Severity: Keywords:
Cc: Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

The Tor configuration used in the EC2 images includes "ORPort 443" and AccountingMax. This combination can make Tor stop working when it tries to re-attach the port after a period of hibernation.

Sebastian explained the problem on IRC; When Tor starts, it will open 443 as root and then drop its privileges. When Tor goes into hibernation, it closes the port. When Tor comes out of hibernation, it tries to reopen the port, and fails (non-root users aren't allowed to open ports lower than 1025).

The solution here is to advertise 443, but listen on 9001 (or another high port). This means that we need to have a firewall rule (e.g. using iptables) that can redirect the traffic.

Child Tickets

Change History (3)

comment:2 Changed 8 years ago by runa

I hear this should work; iptables -t nat -A prerouting -i <iface> -p <tcp/udp> --dport <#> -j REDIRECT --to-port <#>

comment:3 Changed 8 years ago by runa

Resolution: fixed
Status: newclosed

Fixed in ec2-prep.sh, tested on an EC2 instance.

Note: See TracTickets for help on using tickets.