[tor-relays] snowflake vs bridges (vs node)

[Fran]

Thanks meskio, this helped a lot to clarify things.

So I thought of trying to run a bride and a snowflakeproxy on one VM 
with individual IP addressing in v4 and v6 for each by adding secondary 
addresses to to the WAN interface. But after compiling the go binary I 
fail to find out how to tell snowflake which IP to bind to/use.

For the bridge this can be achieved with:

Address  <IPv4>
Address  <IPv6>
OutboundBindAddress <IPv4>
OutboundBindAddress <IPv6>

(and maybe to be save also set OutboundBindAddressPT, 
OutboundBindAddressExit and OutboundBindAddressOR)

But for snowflake I'm missing the options:

Usage of ./proxy:
   -broker string
     	broker URL (default "https://snowflake-broker.torproject.net/")
   -capacity uint
     	maximum concurrent clients
   -keep-local-addresses
     	keep local LAN address ICE candidates
   -log string
     	log filename
   -nat-retest-interval duration
     	the time interval in second before NAT type is retested, 0s 
disables retest. Valid time units are "s", "m", "h".  (default 24h0m0s)
   -relay string
     	websocket relay URL (default "wss://snowflake.bamsoftware.com/")
   -stun string
     	broker URL (default "stun:stun.stunprotocol.org:3478")
   -summary-interval duration
     	the time interval to output summary, 0s disables retest. Valid 
time units are "s", "m", "h".  (default 1h0m0s)
   -unsafe-logging
     	prevent logs from being scrubbed
   -verbose
     	increase log verbosity

Could be solved with VRFs/namespaces but would involve bridging, 
veths...too snowflaky for me (same goes for containers).

So I guess I'll just keep the bridges and make then relays one day.

Thanks for all who helped!

best
fran


On 2/7/22 11:12, meskio wrote
> Yes, there are many differencies. snowflake does make the traffic look like
> webrtc (like a video conference) and obfs4 makes the traffic look like random
> noise. Also the clients use different mechanisms to discover the relays.
> 
> If you run both in the same IP address and the censor has a way to discover one
> but not the other both of them will be blocked at once. So you are making it
> easier for the censor to discover them and block them. That is why we don't want
> people to run both in the same IP address.