[tor-relays] obfs4 bridge current setup is not entirely clear

[meskio]

Quoting s7r (2023-11-08 17:42:46)
> 1. The page at 
> https://community.torproject.org/relay/setup/bridge/debian-ubuntu/ needs a 
> small revision.

Feel free to send a merge request to improve it:
https://gitlab.torproject.org/tpo/web/community/-/blob/main/content/relay/setup/bridge/debian-ubuntu/contents.lr?ref_type=heads

> 2. It was recommended on the mail list that obfs4 bridges should not open 
> their ORPorts publicly to prevent scanning the entire 1-65536 port range and 
> determine it's a Tor bridge. OK.
> 
> But if you try:
> 
> ORPort 127.0.0.1:auto
> ORPort [::1]:auto
> AssumeReachable 1 # needed to skip ORPort reachability test
> 
> Tor will start but it will constantly complain in the log with:
> 
> [warn] The IPv4 ORPort address 127.0.0.1 does not match the descriptor 
> address REAL_IPv4_ADDRESS. If you have a static public IPv4 address, use 
> 'Address <IPv4>' and 'OutboundBindAddress <IPv4>'. If you are behind a 
> NAT, use two ORPort lines: 'ORPort <PublicPort> NoListen' and 'ORPort 
> <InternalPort> NoAdvertise'.
> 
> [warn] The IPv6 ORPort address ::1 does not match the descriptor address 
> REAL_IPv6_ADDRESS. If you have a static public IPv4 address, use 
> 'Address <IPv6>' and 'OutboundBindAddress <IPv6>'. If you are behind a 
> NAT, use two ORPort lines: 'ORPort <PublicPort> NoListen' and 'ORPort 
> <InternalPort> NoAdvertise'.
> 
> I guess it's OK to continue to run it even with this as I do understand 
> the log messages and it's the desired effect, but isn't it confusing for 
> less experienced users? They might think something is wrong when it is not.

We are still working on supporting no publishing the ORPort. Is not bad to do 
it, but there are some quircks that we need to fix.

> 3. ServerTransportListenAddr can be used just once and it's difficult for 
> dual-stack which is now the vast majority.
> 
> It's known for many years that each pluggable transport supports just 
> one ServerTransportListenAddr line, the second one is simply ignored. 
> Tickets for this exist.
> 
> So what is the best way to for an user to open both IPv4 and IPv6 
> pluggable transport ports?

This is not currently supported, but there is some work done in that direction:
https://gitlab.torproject.org/tpo/core/tor/-/issues/40885
.

-- 
meskio | https://meskio.net/
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
 My contact info: https://meskio.net/crypto.txt
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Nos vamos a Croatan.