How do I run a bridge with obfs3 pluggable transport?

Question

i want to create a Tor bridge which:

• is not an exit node.
• I can use to anonymize my connections to the Internet

Here are the settings in my torrc:

SocksPort 9050
ORPort 9001
ExtORPort auto
Nickname abcdefghijklm
ContactInfo < name AT xyz dot vw >
ExitPolicy reject * : *
BridgeRelay 1
ServerTransportPlugin obfs3 exec /usr/bin/obfsproxy managed

Is it good? How can it be improved?

Answer 1

Bridges aren't published, they won't be used as exits but the reject policy won't cause any harm.

The config looks good and it should work.

I might be worth a few small changes though, they may not be relevant to your use case but...

• Consider using obfs4 rather than obfs3 for the pluggable transport provider. It's what is currently recommended and it's resistant to more forms of censorship that obfs3. For example an attacker who sees you connecting to an obfs3 IP/Port, could make its own connection and discover that it is a Tor bridge, conversely due to the design of the obfs4 protocol this same attack would not work against it.
• Consider changing the ORPort to something non-default. Unfortunately the current state of bridges is that they must expose their ORPort even if it's not going to be used. An ORPort is an obvious fingerprint of a Tor relay (it speaks the OR protocol to anyone that tries) and as such running it on a default port might more readily reveal that it is a bridge to a curious observer.

Answer 2

a guide to install obfs4proxy

i assume you use linux Opensuse 13.1. In this case opensuse does not supply any obfs4proxy package

1. install "go" language >= 1.2 in this case 1.6 version

install "go" and "go-language" packages

from repo "devel:languages:go"

in "http://download.opensuse.org/repositories/devel:/languages:/go/openSUSE_13.1/"

2 create in your home folder somewhere a folder for example "obfs4proxy"

3 open a text console

go to /home///obfs4proxy/

execute the commands:

export GOPATH=/home///obfs4proxy

go get git.torproject.org/pluggable-transports/obfs4.git/obfs4proxy

this copies the source of obfs4proxy

in /home///obfs4proxy/src/

then

this computes the binary of obfs4proxy

in /home///obfs4proxy/bin/

4. wiht admin right

if there is no error when compting the binary

copy the file /home///obfs4proxy/bin/obfs4proxy

to the folder /usr/bin/

in the file /etc/tor/torrc

add the statements relative to the obfs4proxy

ExtORPort auto

ServerTransportPlugin obfs4 exec /usr/bin/obfs4proxy

5 restart Tor service with the yast service management tool

go to see the file /var/log/tor/tor.log

there is an info like this

Registered server transport 'obfs4' at '[::]:'

in the firewall you must authorize the tcp port for incoming connections

is a random number from an installation to another installation and is the same from a start to another start of tor service for your installation.

thanks to this doc

https://github.com/Yawning/obfs4