Run a Tor relay without breaking the acceptable use policy

What is permitted

Middle relays, guards and bridges are fine at every site and need no ticket. Exit relays are permitted at some sites and not others, and we ask you to open a ticket before starting one so that the abuse desk is not surprised and neither are you.

The acceptable use policy prohibits three things, and running a relay is not among them. The constraint on exits is practical rather than moral: some upstreams tolerate the complaint volume and some do not, and we would rather tell you which is which than move you afterwards.

Install

apt install -y tor

AlmaLinux needs the extra package repository first:

dnf install -y epel-release
dnf install -y tor

Configure a middle relay

In /etc/tor/torrc:

Nickname relay01
ORPort 443
ORPort [<ipv6>]:443
ContactInfo [email protected]
ExitRelay 0
SocksPort 0
RelayBandwidthRate 20 MBytes
RelayBandwidthBurst 40 MBytes

Nicknames are alphanumeric and at most nineteen characters, which catches everybody once. SocksPort 0 stops the relay offering a proxy to the internet, which it should never do. ContactInfo should be an address you read: a working contact in the consensus means most complaints reach you directly instead of arriving here first.

RelayBandwidthRate is a limit rather than a suggestion. Set it so a busy relay stays inside the fair-use figure for your port, and remember the traffic is symmetric — everything that comes in goes back out again.

systemctl enable --now tor
journalctl -u tor -f

Wait for Self-testing indicates your ORPort is reachable from the outside. If it never appears, the firewall is the reason nine times out of ten:

nft add rule inet filter input tcp dport 443 accept

DirPort is gone. Modern tor serves directory data over the ORPort, and setting one achieves nothing.

Capping the month

AccountingMax 20 TBytes
AccountingStart month 1 00:00

The relay hibernates when it reaches the limit rather than dropping circuits mid-stream, which is better for the network than a hard stop and better for you than a graph you have to explain.

Exits, if you are going to

• Open the ticket first. Tell us the site, the exit policy, and the contact address.
• Use a reduced exit policy. The ports it drops generate most of the complaints and almost none of the value.
• Run it on an instance that does nothing else. That address will end up on blocklists, and you do not want it also serving your mail.
• Publish something at the address. A plain page on port 80 explaining what the machine is resolves a surprising share of complaints before a human reads them.
• Set the reverse DNS to something self-describing, for the same reason.

Abuse mail is forwarded to your account address unmodified. We do not pull a relay because somebody is annoyed by it. The three prohibitions still apply and an exit does not suspend them, but traffic crossing an exit towards a third party is not the operator attacking that third party, and we understand the difference.

Bridges

apt install -y obfs4proxy

BridgeRelay 1
ORPort 443
ServerTransportPlugin obfs4 exec /usr/bin/obfs4proxy

A bridge at an address nobody has enumerated is worth more than another relay in a city that already has thousands. Our quieter sites are useful for precisely that, and Chișinău, Sofia and Riga are all on the locations page.