I would like to consider a particular use cases of available an
resilient IP addresses for Exit traffic.
Let's split the Traffic of a Tor Relay with a relaxed Exit Policy.
If we assume that the node will have 66.66% of Non-Tor-Exit-Traffic, we
would be saying that only 1/3 of that Tor Relay may be abuse generating.
If we assume that all traffic going to Top-30-Internet-Destinations does
not generate abuse, that can be recognized by Autonomous System Numbers
[1], and that represent 50% of Tor Exit Traffic, the
non-abuse-generating traffic would be an average 1/2 of the remaining
33.33% that's 16.6% leaving to a total of non-abuse-generating-traffic
of 83.26% with only 16.74% of possibly-abuse-generating-traffic.
By using the new OutboundBindAddressExit directive that enable to
specify outbound Tor Exit traffic and by matching traffic going to
specific autonomous system with iptables, it would be possible to divert
the remaining 16.74% of traffic that could be abuse generating to a
remote end-point providing only
Tor-Exit-Possibly-Abuse-Generating-Endpoint-On-Controlled-IP-Addresses.
So this hypothetical
Tor-Exit-Possibly-Abuse-Generating-Endpoint-On-Controlled-IP-Addresses
would be able to handle about 1/6th of a Tor relay traffic handling
almost all possibly abusive traffic, enabling running Tor also on cheap
VPS where a single abuse may takeover the VPS?
[1] https://trac.torproject.org/projects/tor/ticket/18268
On 12/06/2017 22:51, Moritz Bartl wrote:
Hi,
After some trouble and ongoing discussions with one of our IP providers,
we're again toying with the idea of registering IP space with RIPE
ourselves. We can apply for a /22, which can be split into four /24s and
announced at different locations (254 addresses each).
Until now, we tried to avoid that, because we don't have enough "other
things" to put on the same netblocks, so basically "one exit" would
waste 254 precious IPv4 addresses (the full /24 address block needs to
be announced from one location). But lately, with the rising amount not
of abuse but of automated notifications and scared ISPs, and with the
sponsoring of up to 10GE by Community-IX, we would really like at least
one /24.
Gareth from Brasshorn has graciously offered a spare /24 of his. The
alternative would be that we apply for our own IP space, which would in
turn mean that we could supply three other organizations with a /24 for
their exit(s), or bridges. For bridges it is actually not that crazy,
even if the range is "known" and easy to find: Most censors won't
auto-detect them easily, and even if some do, the bridges are still
valuable in many other locations. Also, this would allow for a bit of
experimenting with tarpitting, different decoy strategies, etc.
In terms of WHOIS information, the /24 can be segregated further, so an
option would be to use a location where you have other uses for larger
number of IP addresses.
If you like the idea, and have actual use for a /24, please contact me
off-list and explain what exactly you would like to do with it. If we
have three other organizations (or reliable individuals) and a couple of
good use cases, we're willing to apply for the /22.
