[tor-relays] Question Re: firewall rules for obfs4 bridge relay

[torrelay.europa at keemail.me]

Hello,

I'm in the process of setting up a couple of obfs4 bridge relays on Ubuntu server 18.04.  

I'm endeavoring to apply strict firewall rules to ensure only the necessary ports are open. 

In accordance with the configuration (below) I've allowed port 9001:

#Bridge config
RunAsDaemon 1
ORPort 9001
BridgeRelay 1
ServerTransportPlugin obfs4 exec /usr/bin/obfs4proxy
ExtORPort auto

#Set your bridge nickname and contact info
ContactInfo <your-contact-info>
Nickname pick-a-nickname

I've also allowed port 9051 to enable me to connect to the obfs4 server via onionbox.

After starting the Tor service the Tor logs report,

Opening Socks listener on 127.0.0.1:9050

Opening Control listener on 127.0.0.1:9051

Opening OR listener on 0.0.0.0:9001

Extended OR listener listening on port XXXXX.

Registered server transport 'obfs4' at '[::]:33919'

All of the ports listed (above) appear to be fixed ports that open each time I start/restart Tor. However, the "Extended OR listener listening on port XXXXX" changes on each start/restart. 

I can see the configuration (above) instructs ExtORPort auto. 

I've looked online where there is some advice suggesting the auto setting for ExtORPort is important for security reasons, however, if I'd like to have strict firewall rules the auto setting becomes problematic.
Currently, I've allowed port 9001 & the Tor logs report,

Now checking whether ORPort XXX.XXX.XXX.XX:9001 is reachable...

Self-testing indicates your ORPort is reachable from the outside. 

I'd be grateful for some advice on which ports I should keep open, to ensure I can provide the very best service & good security practice both for the client & the server - thanks :)

Best regards,

Kenneth







-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.torproject.org/pipermail/tor-relays/attachments/20181003/efe27ec0/attachment.html>