How to run a Tor relay, and why yours should not be an exit
How to run a Tor relay, for almost everyone who asks, is: a middle relay, on a server, with the exit turned off. Not on the laptop you browse from, and not an exit from a home connection. The users of the network are the ones who stay hidden. The operator is published. Your address goes into the public list of relays, and that is the point of the job. Where that relay sits in the three hops is the page about Tor itself.
Which kind to run
There are four ways to help, and only one of them should be your first.
| Kind | What it does | Run it if |
|---|---|---|
| Middle, which may later be a guard | Carries traffic between other relays. Does not open websites for anyone. | You have a server, a public address, and about 10 megabits in each direction. This is the start. |
| Exit | The last hop. The website sees your address, and the complaints come to you. | An organisation can answer abuse mail and a police question. Tor's own line is not to run one from home. |
| Bridge | A relay that is not in the public list, so it is harder to block. | You are at home, on one address, or you have at least 1 megabit and not 10. What the people using it are trying to get past is a different page. |
| Snowflake | A small proxy that helps someone reach Tor when the public relays are blocked. | You do not meet the bar for a relay or a bridge. It is still a real contribution. |
You do not apply to be a guard. A guard is a middle relay that has stayed up and is fast enough, at least 2 megabytes a second each way. Otherwise it stays a middle. Two megabytes a second is the same 16 megabits the requirements page asks you to have spare. The flag arrives because the relay earned it. Setting a nickname does not grant it.
The numbers that decide it before you install anything
A relay needs 10 megabits a second up and down. Sixteen is what they recommend. Under 10, but at least 1, they would rather you run a bridge. The monthly figure sounds small until you do their arithmetic: 100 gigabytes out, and the same in, is the minimum, and they note that a 10 megabit line burns through 100 gigabytes in about a day. Two terabytes a month is what they actually want. A metered plan is how a relay becomes a bill.
The connection count is the one that kills a home router. A non-exit relay should handle at least 7,000 connections at once. A fast exit, over 100 megabits, is in another league, around 100,000. A data-centre network shrugs. The router in a flat often does not, and the failure looks like the internet dying for everyone in the house, not like a Tor error.
The rest is modest. Under 40 megabits, 512 megabytes of RAM is the floor, and 1 gigabyte above that. An exit wants 1.5 gigabytes. Disk is under 200 megabytes for Tor itself. Any recent processor is enough. The address has to be a public IPv4, and it should sit still for at least three hours. You can put eight relays on one address, and no more. If the relay is down for all but two hours a day, Tor says it is barely useful. A box that stays on is the requirement that matters more than a fast one you reboot every evening.
Five lines, and the two that keep you out of trouble
On Debian or Ubuntu the install is the Tor Project's package, not whatever older copy the distribution still ships, and then a short file at /etc/tor/torrc. Their Debian page is the one to follow for the repository and the updates. The file they want is this:
Nickname myNiceRelay
ContactInfo your@e-mail
ORPort 443
ExitRelay 0
SocksPort 0- Nickname
- The public name. Relay Search will find you by it. It is not a secret.
- ContactInfo
- An email that will be published with the relay. Use one you are willing to see on a list.
- ORPort
- The port other relays connect to. 443 is Tor's suggestion. Whatever you pick has to be open inbound.
- ExitRelay 0
- This relay does not open websites for anyone. Removing the line, or setting it to 1, makes you an exit.
- SocksPort 0
- This Tor process is not a proxy for programs on the machine. Your browsing stays in Tor Browser.
Port 443 is their suggestion because it looks like ordinary web traffic to a clumsy filter. Another port works if 443 is taken. Leave ExitRelay 0 where it is. A relay does not make the computer it runs on anonymous. It publishes the address.
Restart with systemctl restart tor@default. Open the port you chose, incoming, and let the server make outgoing connections or it cannot reach the rest of the network. The log you want, once the port is open, is the one on Tor's post-install page: the relay has tested that its port is reachable from the outside, and it is publishing a descriptor. Then look it up on Relay Search by the nickname. It will not be there in the first minute.
Your address joins a public list
Guard, middle and exit addresses are public on purpose. Bridges are the ones left off the list. A middle relay usually does not get abuse complaints. It can still be blocked by a bank or a streaming site that treats every address in that list as a Tor user. If that address is also your home connection, the block hits the television and the banking app, not just the relay. That is why Tor tells someone with one home address to run a bridge or a Snowflake proxy instead.
An exit is the relay the website sees. A copyright notice, in Tor's own example, comes to the operator, or to the company whose name is on the address registration. Most of those letters are routine. Some are not, and a flat is a bad place to find out which. An organisation with someone whose job is to answer mail is who an exit is for. The ports you allow decide how much of that mail you get. A useful exit has to allow at least web traffic, ports 80 and 443. Opening more helps the network and raises the volume of complaints. The exit guide is where that policy is set, and it is a later decision, not the first afternoon.
Nothing here is a promise about your local law. Tor's position is the practical one: do not run an exit from home, and read the legal notes before you run one at all. A middle relay on a rented server, with the host's permission, is the contribution that does not require you to become the person a website complains about.