2 Tor's (little) Firewall Helper specification
7 This document describes issues faced by Tor users who are behind NAT devices
8 and wish to share their resources with the rest of the Tor network. It also
9 explains a possible solution for some NAT devices.
13 Tor users often wish to relay traffic for the Tor network and their upstream
14 firewall thwarts their attempted generosity. Automatic port forwarding
15 configuration for many consumer NAT devices is often available with two common
16 protocols NAT-PMP[0] and UPnP[1].
20 tor-fw-helper is a program that implements basic port forwarding requests; it
21 may be used alone or called from Tor itself.
25 When tor-fw-helper has completed the requested action successfully, it will
26 report the following message to standard output:
28 tor-fw-helper: SUCCESS
30 If tor-fw-helper was unable to complete the requested action successfully, it
31 will report the following message to standard error:
33 tor-fw-helper: FAILURE
35 All informational messages are printed to standard output; all error messages
36 are printed to standard error. Messages other than SUCCESS and FAILURE
37 may be printed by any compliant tor-fw-helper.
39 2.2 Output format stability
41 The above SUCCESS and FAILURE messages are the only stable output formats
42 provided by this specification. tor-fw-helper-spec compliant implementations
43 must return SUCCESS or FAILURE as defined above.
47 It is probably best to hand configure port forwarding and in the process, we
48 suggest disabling NAT-PMP and/or UPnP. This is of course absolutely confusing
49 to users and so we support automatic, non-authenticated NAT port mapping
50 protocols with compliant tor-fw-helper applications.
52 NAT should not be considered a security boundary. NAT-PMP and UPnP are hacks
53 to deal with the shortcomings of user education about TCP/IP, IPv4 shortages,
54 and of course, NAT devices that suffer from horrible user interface design.
56 [0] http://en.wikipedia.org/wiki/NAT_Port_Mapping_Protocol
57 [1] http://en.wikipedia.org/wiki/Universal_Plug_and_Play