i want to create a Tor bridge which:

  • is not an exit node.
  • I can use to anonymize my connections to the Internet

Here are the settings in my torrc:

SocksPort 9050
ORPort 9001
ExtORPort auto
Nickname abcdefghijklm
ContactInfo < name AT xyz dot vw >
ExitPolicy reject * : *
BridgeRelay 1
ServerTransportPlugin obfs3 exec /usr/bin/obfsproxy managed

Is it good? How can it be improved?

2 Answers 2


Bridges aren't published, they won't be used as exits but the reject policy won't cause any harm.

The config looks good and it should work.

I might be worth a few small changes though, they may not be relevant to your use case but...

  • Consider using obfs4 rather than obfs3 for the pluggable transport provider. It's what is currently recommended and it's resistant to more forms of censorship that obfs3. For example an attacker who sees you connecting to an obfs3 IP/Port, could make its own connection and discover that it is a Tor bridge, conversely due to the design of the obfs4 protocol this same attack would not work against it.
  • Consider changing the ORPort to something non-default. Unfortunately the current state of bridges is that they must expose their ORPort even if it's not going to be used. An ORPort is an obvious fingerprint of a Tor relay (it speaks the OR protocol to anyone that tries) and as such running it on a default port might more readily reveal that it is a bridge to a curious observer.
  • > Bridges aren't published, they won't be used as exits but the reject policy won't cause any harm Commented Jun 11, 2016 at 7:04
  • how to use obfs4? i used "pip install obfsproxy" and this install obfsproxy. just change obfs3 by obfs4 in the statement in torrc? Commented Jun 11, 2016 at 7:14
  • 1
    See this answer: tor.stackexchange.com/a/6371/12737
    – cacahuatl
    Commented Jun 11, 2016 at 15:18
  • a guide to install obfs4proxy Commented Jun 12, 2016 at 17:34

a guide to install obfs4proxy

i assume you use linux Opensuse 13.1. In this case opensuse does not supply any obfs4proxy package

  1. install "go" language >= 1.2 in this case 1.6 version

install "go" and "go-language" packages

from repo "devel:languages:go"

in "http://download.opensuse.org/repositories/devel:/languages:/go/openSUSE_13.1/"

2 create in your home folder somewhere a folder for example "obfs4proxy"

3 open a text console

go to /home///obfs4proxy/

execute the commands:

export GOPATH=/home///obfs4proxy

go get git.torproject.org/pluggable-transports/obfs4.git/obfs4proxy

this copies the source of obfs4proxy

in /home///obfs4proxy/src/


this computes the binary of obfs4proxy

in /home///obfs4proxy/bin/

  1. wiht admin right

if there is no error when compting the binary

copy the file /home///obfs4proxy/bin/obfs4proxy

to the folder /usr/bin/

in the file /etc/tor/torrc

add the statements relative to the obfs4proxy

ExtORPort auto

ServerTransportPlugin obfs4 exec /usr/bin/obfs4proxy

5 restart Tor service with the yast service management tool

go to see the file /var/log/tor/tor.log

there is an info like this

Registered server transport 'obfs4' at '[::]:'

in the firewall you must authorize the tcp port for incoming connections

is a random number from an installation to another installation and is the same from a start to another start of tor service for your installation.

thanks to this doc


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .