2

I have a small VPS service that I use primarily to run a tor bridge (and also a VPN).

Sometimes I travel to China for work, so I have the bridge configured as unlisted and only connect to it with obfs4 - and it manages to not get blocked by the Great Firewall. For convenience I have all my various devices configured to use the bridge, even when at home.

For $5 a month, I have 1,000 GB of monthly bandwidth with this server, but I never come close to using it all. There is an option (for an extra $2 per month) to add an extra IPv4 address. I am thinking of somehow configuring tor to use one IP address as the unlisted obfs4 bridge, and to run a middle relay on the other IP address.

Are there any potential problems with doing this? If not, then are there any instructions on how I might go about this? Do I need to run two tor instances, or can I somehow do it all with one?

Improve this question

1 Answer 1

Reset to default
3

You'd need to run two Tor instances, one for the published relay and the other for the bridge.

The important part will be in specifying the correct IP address to bind to and listen on for the obfs4proxy and orports.

Assuming you had two IP addresses with 1.1.1.1 being your relay and 2.2.2.2 being your bridge, your config would look something like this

/etc/tor/torrc:

orport 1.1.1.1:9001
nickname whatever
contact [email protected]
...your other config options here...

This is just your current relay configuration.

If you're on debian using the Tor Projects repo, you should just be able to run (as root):

tor-instance-create bridge

This should create the required settings, and give it a torrc located at /etc/tor/instances/bridge/torrc, edit it following the template below

/etc/tor/instances/bridge/torrc:

# some random, uncommon and high numbered port to frustrate discovery
orport 2.2.2.2:30393
# change path as appropriate
servertransportplugin obfs4 exec /usr/bin/obfs4proxy
# some port of your choosing
servertransportlistenaddr 2.2.2.2:443
# who we are
nickname whatever
contact [email protected]
# disable socksport, we're not a client
socksport 0
# if, as your question suggests you dont want to publish it to bridgedb
publishserverdescriptor 0

Now to enable and start the newly created tor daemon instance, run (as root):

systemctl enable tor@bridge
systemctl start tor@bridge

You should be able to view the logs and ensure everything is working correctly by running (as root):

journalctl -u tor@bridge
Improve this answer
2
  • I'm using Ubuntu 16.04, I just checked and I do have the tor-instance-create option - I'll give this a go as soon as I can, then mark as the correct answer. I'm assuming it will work though. Thanks!
    – seanlano
    Commented Nov 25, 2016 at 4:31
  • OK, this has worked for me! :) I actually used twice the tor-instance-create utility, so now I have two systemd services and config directories, [email protected] and [email protected]. I disabled the default with systemctl disable [email protected] - I figured it would be neater to manage this way.
    – seanlano
    Commented Nov 29, 2016 at 0:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .