tor-fw-helper-spec.txt 2.6 KB

  1. Tor's (little) Firewall Helper specification
  2. Jacob Appelbaum
  3. 0. Preface
  4. This document describes issues faced by Tor users who are behind NAT devices
  5. and wish to share their resources with the rest of the Tor network. It also
  6. explains a possible solution for some NAT devices.
  7. 1. Overview
  8. Tor users often wish to relay traffic for the Tor network and their upstream
  9. firewall thwarts their attempted generosity. Automatic port forwarding
  10. configuration for many consumer NAT devices is often available with two common
  11. protocols NAT-PMP[0] and UPnP[1].
  12. 2. Implementation
  13. tor-fw-helper is a program that implements basic port forwarding requests; it
  14. may be used alone or called from Tor itself.
  15. 2.1 Output format
  16. 2.1.1. Motivation
  17. tor-fw-helper should be able to signal to tor whether its actions
  18. succeeded so that tor can act accordingly. For this reason it's
  19. important to standarize the output format of tor-fw-helper.
  20. tor-fw-helper outputs signalling commands to stdout, and debugging
  21. messages to stderr. This means that a program that launches
  22. tor-fw-helper only needs to monitor stdout to learn its status.
  23. 2.1.2. TCP forwarding output
  24. When tor-fw-helper completes a TCP forwarding action, it prints the
  25. following message to standard output:
  26. tor-fw-helper tcp-forwarding <external port> <internal port> <status> [<message>]
  27. where,
  28. <external port>, is the TCP port in the external side of the NAT
  29. device that was forwarded.
  30. <internal port>, is the TCP port in the internal side of the NAT
  31. device that accepts forwarded traffic.
  32. <status>, is either "SUCCESS" or "FAIL".
  33. <message>, is an optional supplementary message that can include
  34. multiple words.
  35. For example, upon successfully using NAT-PMP to forward connections from
  36. port '4200' to port '4333', tor-fw-helper would output in stdout:
  37. tor-fw-helper tcp-forwarding 4200 4333 SUCCESS NAT-PMP succeded
  38. 3. Security Concerns
  39. It is probably best to hand configure port forwarding and in the process, we
  40. suggest disabling NAT-PMP and/or UPnP. This is of course absolutely confusing
  41. to users and so we support automatic, non-authenticated NAT port mapping
  42. protocols with compliant tor-fw-helper applications.
  43. NAT should not be considered a security boundary. NAT-PMP and UPnP are hacks
  44. to deal with the shortcomings of user education about TCP/IP, IPv4 shortages,
  45. and of course, NAT devices that suffer from horrible user interface design.
  46. [0]
  47. [1]