bitcoind running as Tor hidden service: When LAN IP gets banned -> no incoming connections anymore #9248

Bitcoin 0.13.1

E.g. having Tor service running on LAN IP 192.168.9.5

(which ORPort is natted from the WAN router) and with Tor hidden service configuration

HiddenServicePort 8333 192.168.9.10:8333

and running bitcoind with onlynet=tor on another LAN host with IP 192.168.9.10, Port 8333

then on bitcoind one sees the connections all from IP 192.168.9.5 with different source ports, of course.

Now I have the following in the debug log:

Misbehaving: 192.168.9.5:42853 (0 -> 200) BAN THRESHOLD EXCEEDED connection from 192.168.9.5:42858 dropped (banned) connection from 192.168.9.5:42860 dropped (banned) connection from 192.168.9.5:42870 dropped (banned) connection from 192.168.9.5:42883 dropped (banned) connection from 192.168.9.5:42886 dropped (banned)

The IP 192.168.9.5 was blocked, and since that is the Tor hidden service IP, all incoming connections are blocked.

So, I need to whitelist the IP 192.168.9.5, but then the ban function would be lost.

Clients of a Tor hidden service could only be identified on an upper application layer, since the source IP is obviously unknown.

Maybe with onlynet=tor, IP address banning should automatically be disabled?

onlynet=tor deals with outbound connections. Tor running on another host isn't something our setup really anticipates -- localhost is exempt from banning. We are probably due to add a torlistenport for other reasons in any case.

OK, let me get this right. Assume having the following configuration (Tor on localhost with hidden service):

onlynet=onion
proxy=127.0.0.1:9050
listen=1
externalip=abcdefghijklmnop.onion

Then all incoming connections bitcoind sees coming from localhost, with every peer just with different source port, but all the same IP (127.0.0.1). And since localhost is, as You said exempt from banning, there is in fact banning disabled? So should I just, in my case, whitelist my externel Tor IP address from which all my incoming tor connections come, to prevent one possible bad guy to DoS my whole node? Thanks for clearification.

When running Tor Hidden Service, the IP address of the Tor node must be whitelisted, since it is used by all users of the Hidden Service. IP blocking is senseless with Tor. Nodes could only be banned by an application protocol layer e.g. "Bitcoin Node ID".