{"id":24895,"date":"2018-06-11T16:30:51","date_gmt":"2018-06-11T16:30:51","guid":{"rendered":"http:\/\/www.sickgaming.net\/blog\/2018\/06\/11\/turn-your-raspberry-pi-into-a-tor-relay-node\/"},"modified":"2018-06-11T16:30:51","modified_gmt":"2018-06-11T16:30:51","slug":"turn-your-raspberry-pi-into-a-tor-relay-node","status":"publish","type":"post","link":"https:\/\/sickgaming.net\/blog\/2018\/06\/11\/turn-your-raspberry-pi-into-a-tor-relay-node\/","title":{"rendered":"Turn Your Raspberry Pi into a Tor Relay Node"},"content":{"rendered":"<div><img decoding=\"async\" src=\"http:\/\/www.sickgaming.net\/blog\/wp-content\/uploads\/2018\/06\/turn-your-raspberry-pi-into-a-tor-relay-node.jpg\" class=\"ff-og-image-inserted\" \/><\/div>\n<p>If you\u2019re anything like me, you probably got yourself a first- or second-generation Raspberry Pi board when they first came out, played with it for a while, but then shelved it and mostly forgot about it. After all, unless you\u2019re a robotics enthusiast, you probably don\u2019t have that much use for a computer with a pretty slow processor and 256 megabytes of RAM. This is not to say that there aren\u2019t cool things you can do with one of these, but between work and other commitments, I just never seem to find the right time for some good old nerding out.<\/p>\n<p>However, if you would like to put it to good use without sacrificing too much of your time or resources, you can turn your old Raspberry Pi into a perfectly functioning Tor relay node.<\/p>\n<h3>What is a Tor Relay node<\/h3>\n<p>You have probably heard about the <a href=\"https:\/\/www.torproject.org\/\">Tor project<\/a> before, but just in case you haven\u2019t, here\u2019s a very quick summary. The name \u201cTor\u201d stands for \u201cThe Onion Router\u201d and it is a technology created to combat online tracking and other privacy violations.<\/p>\n<p>Everything you do on the Internet leaves a set of digital footprints in every piece of equipment that your IP packets traverse: all of the switches, routers, load balancers and destination websites log the IP address from which your session originated and the IP address of the internet resource you are accessing (and often its hostname, <a href=\"https:\/\/en.wikipedia.org\/wiki\/Server_Name_Indication#Security_implications\">even when using HTTPS<\/a>). If you\u2019re browsing from home, then your IP can be directly mapped to your household. If you\u2019re using a VPN service (<a href=\"https:\/\/www.linux.com\/blog\/2017\/10\/tips-secure-your-network-wake-krack\">as you should be<\/a>), then your IP can be mapped to your VPN provider, and then they are the ones who can map it to your household. In any case, odds are that someone somewhere is assembling an online profile on you based on the sites you visit and how much time you spend on each of them. Such profiles are then sold, aggregated with matching profiles collected from other services, and then monetized by ad networks. At least, that\u2019s the optimist\u2019s view of how that data is used &#8212; I\u2019m sure you can think of many examples of how your online usage profiles can be used against you in much more nefarious ways.<\/p>\n<p>The Tor project attempts to provide a solution to this problem by making it impossible (or, at least, unreasonably difficult) to trace the endpoints of your IP session. Tor achieves this by bouncing your connection through a chain of anonymizing relays, consisting of an entry node, relay node, and exit node:<\/p>\n<ol>\n<li>\n<p>The <strong>entry node<\/strong> only knows your IP address, and the IP address of the relay node, but not the final destination of the request;<\/p>\n<\/li>\n<li>\n<p>The <strong>relay node<\/strong> only knows the IP address of the entry node and the IP address of the exit node, and neither the origin nor the final destination<\/p>\n<\/li>\n<li>\n<p>The <strong>exit node<\/strong><strong> <\/strong>only knows the IP address of the relay node and the final destination of the request; it is also the only node that can decrypt the traffic before sending it over to its final destination<\/p>\n<\/li>\n<\/ol>\n<p>Relay nodes play a crucial role in this exchange because they create a cryptographic barrier between the source of the request and the destination. Even if exit nodes are controlled by adversaries intent on stealing your data, they will not be able to know the source of the request without controlling the entire Tor relay chain.<\/p>\n<p>As long as there are plenty of relay nodes, your privacy when using the Tor network remains protected &#8212; which is why I heartily recommend that you set up and run a relay node if you have some home bandwidth to spare.<\/p>\n<h4>Things to keep in mind regarding Tor relays<\/h4>\n<p>A Tor relay node only receives encrypted traffic and sends encrypted traffic &#8212; it never accesses any other sites or resources online, so you do not need to worry that someone will browse any worrisome sites directly from your home IP address. Having said that, if you reside in a jurisdiction where offering anonymity-enhancing services is against the law, then, obviously, do not operate your own Tor relay. You may also want to check if operating a Tor relay is against the terms and conditions of your internet access provider.<\/p>\n<h3>What you will need<\/h3>\n<ul>\n<li>\n<p>A Raspberry Pi (any model\/generation) with some kind of enclosure<\/p>\n<\/li>\n<li>\n<p>An SD card with <a href=\"https:\/\/www.raspberrypi.org\/downloads\/raspbian\/\">Raspbian Stretch Lite<\/a><\/p>\n<\/li>\n<li>\n<p>An ethernet cable<\/p>\n<\/li>\n<li>\n<p>A micro-USB cable for power<\/p>\n<\/li>\n<li>\n<p>A keyboard and an HDMI-capable monitor (to use during the setup)<\/p>\n<\/li>\n<\/ul>\n<p>This guide will assume that you are setting this up on your home connection behind a generic cable or ADSL modem router that performs NAT translation (and it almost certainly does). Most of them have a USB port you can use to power up your Raspberry Pi, and if you\u2019re only using the wifi functionality of the router, then it should have a free ethernet port for you to plug into. However, before we get to the point where we can set-and-forget your Raspberry Pi, we\u2019ll need to set it up as a Tor relay node, for which you\u2019ll need a keyboard and a monitor.<\/p>\n<h3>The bootstrap script<\/h3>\n<p>I\u2019ve adapted a popular Tor relay node bootstrap script for use with Raspbian Stretch &#8212; you can find it in my GitHub repository here: <a href=\"https:\/\/github.com\/mricon\/tor-relay-bootstrap-rpi\">https:\/\/github.com\/mricon\/tor-relay-bootstrap-rpi<\/a>. Once you have booted up your Raspberry Pi and logged in with the default \u201cpi\u201d user, do the following:<\/p>\n<pre>\nsudo apt-get install -y git\ngit clone https:\/\/github.com\/mricon\/tor-relay-bootstrap-rpi\ncd tor-relay-bootstrap-rpi\nsudo .\/bootstrap.sh<\/pre>\n<p>Here is what the script will do:<\/p>\n<ol>\n<li>\n<p>Install the latest OS updates to make sure your Pi is fully patched<\/p>\n<\/li>\n<li>\n<p>Configure your system for automated unattended updates, so you automatically receive security patches when they become available<\/p>\n<\/li>\n<li>\n<p>Install Tor software<\/p>\n<\/li>\n<li>\n<p>Tell your NAT router to forward the necessary ports to reach your relay (the ports we\u2019ll use are 443 and 8080, since they are least likely to be filtered by your internet provider)<\/p>\n<\/li>\n<\/ol>\n<p>Once the script is done, you\u2019ll need to configure the torrc file &#8212; but first, decide how much bandwidth you\u2019ll want to donate to Tor traffic. First, type \u201c<a href=\"https:\/\/www.google.com\/search?q=speed+test\">Speed Test<\/a>\u201d into Google and click the \u201cRun Speed Test\u201d button. You can disregard the \u201cDownload speed\u201d result, as your Tor relay can only operate as fast as your maximum upload bandwidth.<\/p>\n<p>Therefore, take the \u201cMbps upload\u201d number, divide by 8 and multiply by 1024 to find out the bandwidth speed in Kilobytes per second. E.g. if you got 21.5 Mbps for your upload speed, then that number is:<\/p>\n<pre>\n21.5 Mbps \/ 8 * 1024 = 2752 KBytes per second<\/pre>\n<p>You\u2019ll want to limit your relay bandwidth to about half that amount, and allow bursting to about three-quarters of it. Once decided, open \/etc\/tor\/torrc using your favourite editor and tweak the bandwidth settings.<\/p>\n<pre>\nRelayBandwidthRate 1300 KBytes\nRelayBandwidthBurst 2400 KBytes<\/pre>\n<p>Of course, if you\u2019re feeling more generous, then feel free to put in higher numbers, though you don\u2019t want to max out your outgoing bandwidth &#8212; it will noticeably impact your day-to-day usage if these numbers are set too high.<\/p>\n<p>While you have that file open, you should set two more things. First, the Nickname &#8212; just for your own recordkeeping, and second the ContactInfo line, which should list a single email address. Since your relay will be running unattended, you should use an email address that you regularly check &#8212; you will receive an alert from the \u201cTor Weather\u201d service if your relay goes offline for longer than 48 hours.<\/p>\n<pre>\nNickname myrpirelay\nContactInfo you@example.com<\/pre>\n<p>Save the file and reboot the system to start the Tor relay.<\/p>\n<h3>Testing to make sure Tor traffic is flowing<\/h3>\n<p>If you would like to make sure that the relay is functioning, you can run the \u201carm\u201d tool: <\/p>\n<pre>\nsudo -u debian-tor arm<\/pre>\n<p>It will take a while to start, especially on older-generation boards, but eventually it will show you a bar chart of incoming and outgoing traffic (or error messages that will help you troubleshoot your setup).<\/p>\n<p>Once you are convinced that everything is functioning, you can unplug the keyboard and the monitor and relocate the Raspberry Pi into the basement where it will quietly sit and shuffle encrypted bits around. Congratulations, you\u2019ve helped improve privacy and combat malicious tracking online!<\/p>\n","protected":false},"excerpt":{"rendered":"<p>If you\u2019re anything like me, you probably got yourself a first- or second-generation Raspberry Pi board when they first came out, played with it for a while, but then shelved it and mostly forgot about it. After all, unless you\u2019re a robotics enthusiast, you probably don\u2019t have that much use for a computer with a [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":24896,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[40],"tags":[],"class_list":["post-24895","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-linux-freebsd-unix"],"_links":{"self":[{"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/posts\/24895","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/comments?post=24895"}],"version-history":[{"count":0,"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/posts\/24895\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/media\/24896"}],"wp:attachment":[{"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/media?parent=24895"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/categories?post=24895"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sickgaming.net\/blog\/wp-json\/wp\/v2\/tags?post=24895"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}