Tor Browser is unable to connect to Tor network, connecting to relays failed with TLS_ERROR, so Tor Browser can't connect to bridges.

First and foremost, I am ethnically and biologically Chinese, though I don't regard myself as a Chinese in anyway whatsoever, the point is I am behind the notorious not-so-great "Great Firewall of China", which censors and blocks accesses to free world websites and restricts freedom of speech and freedom of information---and it's very good at what it does.

The GFW implements methods like Deep Packet Inspection, Network Black-holing, DNS Spoofing, Quality of Service, TCP reset and TLS attacking, and it can block Tor Network access, the GFW is not to be underestimated.

I used to edit hosts file to gain access to websites like Wikipedia and DeviantArt that are blocked by DNS poisoning only. I am free to access Wikipedia and DeviantArt and other websites blocked by the same technique. But not websites like Google, Quora etc. that are blocked by more advanced technologies (Black-holing, Man-in-the-middle, TCP reset, Deep Packet Inspection). To gain access to latter websites I need to establish encrypted connection to computers outside of the GFW, and this comes often at a cost of money.

I have no money, otherwise I would use Virtual Private Networks like most imbecile mundane masses do, they pay money to make others do the thinking for them so that they don't need do the thinking themselves. That's why I use Tor, of course I also use other free proxies like ShadowSocksR, Lantern, V2RayN and Psiphon3, but none of them are as reliable as Tor, however none of them are as slow as Tor either.

Tor used to be my most reliable method of bypassing the GFW and almost never failed. Well, it used to be, up until late October 2020, when it suddenly stops working altogether.

So I keep getting error messages. below are an inexhaustive list of them.

Tor failed to establish a Tor network connection. Retrieving network status failed ( done - 0.0.2.0:2).

Unable to obtain a bridge from BridgeDB. NS_ERROR_NET_INTERRUPT

Tor failed to establish a Tor network connection. Loading relay information failed ( done - 0.0.2.0:2).

Tor failed to establish a Tor network connection. Retrieving network status failed (TLS_ERROR - 0.0.2.0:2 ).

And before you start, I have already tried all the steps in the picture below long before it stopped functioning, and I tried again and again and just got the same error messages:

I used to use meek-azure to connect to Tor Network and obfs4 was far less reliable than meek-azure somehow. And I never saw FTE, obfs3 and ScrambleSuit listed in Built-in Bridges drop list, I am sure of it, well I used torbrowser-install-win64-10.0.2_en-US.exe recently before switching to torbrowser-install-10.5a2_en-US.exe, and in these versions there are only obfs4 and meek (and snowflake in 10.5a2). And all of these failed.

Well I gmailed bridges@bridges.torproject.org with "get bridges", "get transport obfs4", and "get ipv6", got the bridges, provided the bridges I know, and they worked, and they worked well, but only the first time, after an hour or so, I don't know how long, the connections got interrupted while using Tor, and Tor can't reconnect to the provided bridges. The problem is I can only send a gmail once every 3 hours and I can only get a maximum of 3 bridges with a minimum of 1 bridge in one reply and I have only one gmail account and all the bridges' ip address have ping round-trip time longer than 250 milliseconds and often time out... (Well I recently found that I can use https://bridges.torproject.org/bridges?transport=obfs4 to get bridges, no 3 hour limit like gmail, but the bridges are also far away.)

So here are some logs, I hope you find it relevant and informational.

11/1/20, 06:02:04.886 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections. 11/1/20, 06:02:04.887 [NOTICE] Opening Socks listener on 127.0.0.1:9150 11/1/20, 06:02:04.887 [NOTICE] Opened Socks listener on 127.0.0.1:9150 11/1/20, 06:02:05.654 [NOTICE] Bridge 'dktoke' has both an IPv4 and an IPv6 address. Will prefer using its IPv6 address ([2a0c:4d80:42:702::1]:27015) based on the configured Bridge address. 11/1/20, 06:02:05.654 [NOTICE] Bootstrapped 1% (conn_pt): Connecting to pluggable transport 11/1/20, 06:02:05.655 [NOTICE] Bootstrapped 2% (conn_done_pt): Connected to pluggable transport 11/1/20, 06:02:05.833 [NOTICE] Ignoring directory request, since no bridge nodes are available yet. 11/1/20, 06:02:07.434 [NOTICE] Bootstrapped 10% (conn_done): Connected to a relay 11/1/20, 06:02:07.805 [NOTICE] Bootstrapped 14% (handshake): Handshaking with a relay 11/1/20, 06:02:08.540 [NOTICE] Bootstrapped 15% (handshake_done): Handshake with a relay done 11/1/20, 06:02:08.542 [NOTICE] Bootstrapped 20% (onehop_create): Establishing an encrypted directory connection 11/1/20, 06:02:08.941 [NOTICE] Bootstrapped 25% (requesting_status): Asking for networkstatus consensus 11/1/20, 06:02:09.540 [NOTICE] Bridge 'dktoke' has both an IPv4 and an IPv6 address. Will prefer using its IPv6 address ([2a0c:4d80:42:702::1]:27015) based on the configured Bridge address. 11/1/20, 06:02:10.555 [NOTICE] Bridge 'dktoke' has both an IPv4 and an IPv6 address. Will prefer using its IPv4 address (45.145.95.6:27015) based on the configured Bridge address. 11/1/20, 06:02:17.130 [NOTICE] Bootstrapped 50% (loading_descriptors): Loading relay descriptors 11/1/20, 06:02:26.698 [WARN] Proxy Client: unable to connect to 209.148.46.65:443 ("general SOCKS server failure") 11/1/20, 06:02:26.699 [WARN] Proxy Client: unable to connect to 144.217.20.138:80 ("general SOCKS server failure") 11/1/20, 06:02:26.699 [WARN] Proxy Client: unable to connect to 146.57.248.225:22 ("general SOCKS server failure") 11/1/20, 06:02:26.700 [WARN] Proxy Client: unable to connect to 85.31.186.98:443 ("general SOCKS server failure") 11/1/20, 06:02:26.701 [WARN] Proxy Client: unable to connect to 38.229.1.78:80 ("general SOCKS server failure") 11/1/20, 06:02:26.701 [WARN] Proxy Client: unable to connect to 38.229.33.83:80 ("general SOCKS server failure") 11/1/20, 06:02:26.702 [WARN] Proxy Client: unable to connect to 193.11.166.194:27015 ("general SOCKS server failure") 11/1/20, 06:02:26.702 [WARN] Proxy Client: unable to connect to 192.95.36.142:443 ("general SOCKS server failure") 11/1/20, 06:02:26.702 [WARN] Proxy Client: unable to connect to 37.218.245.14:38224 ("general SOCKS server failure") 11/1/20, 06:02:26.703 [WARN] Proxy Client: unable to connect to 193.11.166.194:27020 ("general SOCKS server failure") 11/1/20, 06:02:26.703 [WARN] Proxy Client: unable to connect to 193.11.166.194:27025 ("general SOCKS server failure") 11/1/20, 06:02:26.703 [WARN] Proxy Client: unable to connect to 85.31.186.26:443 ("general SOCKS server failure") 11/1/20, 06:02:29.674 [NOTICE] Closing no-longer-configured Socks listener on 127.0.0.1:9150 11/1/20, 06:02:29.674 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections. 11/1/20, 06:02:29.842 [WARN] Pluggable Transport process terminated with status code 0 11/1/20, 06:02:30.594 [NOTICE] Delaying directory fetches: DisableNetwork is set. 11/1/20, 06:02:37.717 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections. 11/1/20, 06:02:37.717 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections. 11/1/20, 06:02:37.717 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections. 11/1/20, 06:02:37.717 [NOTICE] Opening Socks listener on 127.0.0.1:9150 11/1/20, 06:02:37.718 [NOTICE] Opened Socks listener on 127.0.0.1:9150 11/1/20, 06:02:40.154 [NOTICE] Closing no-longer-configured Socks listener on 127.0.0.1:9150 11/1/20, 06:02:40.154 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections. 11/1/20, 06:02:40.154 [WARN] Problem bootstrapping. Stuck at 50% (loading_descriptors): Loading relay descriptors. (DONE; DONE; count 1; recommendation warn; host 97700DFE9F483596DDA6264C4D7DF7641E1E39CE at 0.0.2.0:2) 11/1/20, 06:02:40.154 [WARN] 13 connections have failed: 11/1/20, 06:02:40.154 [WARN] 12 connections died in state handshaking (proxy) with SSL state (No SSL object) 11/1/20, 06:02:40.154 [WARN] 1 connections died in state handshaking (TLS) with SSL state SSLv3/TLS write client hello in HANDSHAKE 11/1/20, 06:02:40.197 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections. 11/1/20, 06:02:40.832 [WARN] Pluggable Transport process terminated with status code 0 11/1/20, 06:09:49.275 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections. 11/1/20, 06:09:49.275 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections. 11/1/20, 06:09:49.275 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections. 11/1/20, 06:09:49.275 [NOTICE] Opening Socks listener on 127.0.0.1:9150 11/1/20, 06:09:49.275 [NOTICE] Opened Socks listener on 127.0.0.1:9150 11/1/20, 06:09:50.278 [NOTICE] Bootstrapped 75% (enough_dirinfo): Loaded enough directory info to build circuits 11/1/20, 06:09:50.549 [NOTICE] Bootstrapped 76% (ap_conn_pt): Connecting to pluggable transport to build circuits 11/1/20, 06:09:50.550 [NOTICE] Bootstrapped 77% (ap_conn_done_pt): Connected to pluggable transport to build circuits 11/1/20, 06:09:52.570 [NOTICE] Closing no-longer-configured Socks listener on 127.0.0.1:9150 11/1/20, 06:09:52.570 [NOTICE] DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections. 11/1/20, 06:09:52.839 [WARN] Pluggable Transport process terminated with status code 0 11/1/20, 06:09:53.354 [NOTICE] Delaying directory fetches: DisableNetwork is set.

I have found \Tor Browser\Browser\TorBrowser\Tor\Tor.exe but when I type tor and enter in cmd (of course I cd'ed to that directory), there are no responces whatsoever, I tried tor /?, tor /help, tor /h, tor -?, tor -h and tor -help, no responces.

I have found \Tor Browser\Browser\TorBrowser\Tor\PluggableTransports directory and there are obfs4proxy.exe and snowflake-client.exe (in 10.5.a2 version), but no fte, scramblesuit and obfs3, how do I get them to use with the latest version and how do I config \Tor Browser\Browser\TorBrowser\Data\Tor\torrc file to actually use them (as clients, not servers)?

I have found \Tor Browser\Browser\TorBrowser\Data\Tor\geoip and geoip6 files which are based on GeoLite2-Country.mmdb on 2019-12-03 and outdated so I updated them. They are now based on 2020-10-27 version of GeoLite2-Country.mmdb.

I want to change Tor Browser ports, are the following correct? SocksListenAddress 127.0.0.1:9180 SocksPort 9180 ControlPort 9081

How do I change default relays used by Tor Browser? I think they might have been compromised so I want to know the relays and make Tor Browser connect to working relays.

And I read somewhere using uTLS and HTTP/2 transport will make Tor Browser more resistant to GFW, how can I do this?

That's all, folks. If you can help me, I would be really grateful.

added For Anticensorship Team label

@phw @cohosh can you look at this?

Thanks for your report, @Estranea. Please send an email to phw@torproject.org and I'll provide you with a private obfs4 bridge, which should work in China. If it also stops working after a while, we need to take a closer look at this.

Also, please use a default Tor Browser. Messing around with your settings makes it more likely for your Tor Browser to fail.

And I read somewhere using uTLS and HTTP/2 transport will make Tor Browser more resistant to GFW, how can I do this?

That must have been some research paper. There's no software that's ready to use.

So I have found a partial workaround, that is, after Tor Browser successfully connects to a provided bridge, immediately go to bridges.torproject.org to get dozens of new bridges and ping their addresses one by one to find usable bridges and paste them to Notepad++, after connection dies again restart Tor Browser and use the previously found bridges to connect to Tor Network and repeat this process over again...(because obfs4 is identifiable)

I find it odd that I can't connect to BridgeDB while not connected to Tor Network, however I can access bridges.torproject.org in Tor Browser if Tor Browser successfully connected to bridges, but after I found accessable IP address of bridges.torproject.org, edited hosts file to append it, saved it, and ipconfig /release, ipconfig /all, ipconfig /flushdns and ipconfig /renew, I can access bridges.torproject.org with unproxied web browsers somehow I still can't contact BridgeDB if Tor Browser isn't connected...

Oh, and I can't "Request a New Bridge" in options menu Tor section after Tor Browser is successfully connected to provided bridges, however I can access bridges.torproject.org in Tor Browser if I just type the address in address bar and press enter, even after hosts file is changed so that unproxied browsers can access bridges.torproject.org normally.

After Tor Browser is successfully connected to provided bridges, "Request a New Bridge" will show "Contacting BridgeDB. Please Wait." text for a really long time and eventually show "Unable to obtain a bridge from BridgeDB. NS_ERROR_NET_INTERRUPT" error message...

However like what I've written above, I can just get new bridges from the website, with Tor Browser and unproxied browsers alike, and I have always succeeded, no fail, it works perfectly, somehow the built-in method of obtaining bridges from BridgeDB always results in failure...

Does the private bridge I sent you work, @Estranea?

Like I said: don't mess with your Tor Browser or operating system settings. When you click on "Request a new bridge", your Tor Browser isn't talking to bridges.torproject.org. Instead, it's contacting BridgeDB's moat interface, which is domain-fronted via Microsoft's Azure CDN.

closed