--- Arjan <sw-vserver@el-c.xs4all.nl> wrote: > > On Monday 22 October 2007, Martin Fick wrote: > > I'm running a tor node in a vserver behind a NAT > router. > > If you're running a tor server, and not using it as > a client to route local traffic through tor, you > don't need the socks stuff. > Set SocksPort to 0 in your torrc to disable it. > > This is all that's in the torrc of my debian-based > tor 0.1.2.17 vserver: > SocksPort 0 > Nickname elc > Address el-c.xs4all.nl > BandwidthRate 50 KB > BandwidthBurst 50 KB > ContactInfo tor-admin@el-c.xs4all.nl > ORPort 9001 > #DirPort 9030 # I disabled this because of my > limited bandwidth > ExitPolicy reject *:* > > If you want to run an exit node, you'll have to use > a different exit policy. > > Because of the NAT, you'll have to forward incoming > traffic on ORPort (and optionally DirPort) to your > tor vserver. This is the part I was unclear about from the tor docs. Do I simply have to configure my router to port forward to the vservers IP or do I have to (the tor docs make it seem like I do) do some NAT/IP forwarding on the linux host also? In other words, is your tor server listening to the private vserver IP? If so, how do the other tor servers know how to contact it? Do they simply wait for your server to contact them and then note the public NATted IP? ... > If you want to enable your SocksPort and > ControlPort, only allow > connections from trusted locations (localhost, or > maybe lan). Also make > sure to setup authentication for the ControlPort if > you enable it. Is there perhaps a large security benefit from running separate tor server and the tor client instances in separate vservers? I.E. If someone breaks into your tor server vserver, they will still not be able to see your local unencrypted tor traffic since it will enter the other (client tor) vserver which does not have any listening ports exposed to the internet? Thanks, -Martin __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com