I have Tor expert bundle v0.2.8.7. I'm trying to configure a relay under Windows 7. After a day of work the relay is still not reachable:

Nov 13 20:08:14.000 [warn] Your server (xx.xx.xx.xx:9001) has not managed to confirm that its ORPort is reachable. Relays do not publish descriptors until their ORPort and DirPort are reachable. Please check your firewalls, ports, address, /etc/hosts file, etc.

I've checked Windows firewall, all connections are allowed. Port 9001 on my router is also opened. I've checked that I'm correctly opening port on my router using utorrent. I've opened port 43634 for it, and it works.

The thing is that when I'm trying to check if port is opened with any online checker, checker says that utorrent port 43634 is "open", and tor port 9001 is "closed", even when Tor is running.

But still Tor works as proxy, and connecting to tor network.

Nov 12 23:07:13.000 [notice] Tor (git-263088633a63982a) opening log file.
Nov 12 23:07:13.148 [notice] Tor v0.2.8.7 (git-263088633a63982a) running on Windows 7 with Libevent 2.0.22-stable, OpenSSL 1.0.1t and Zlib 1.2.8.
Nov 12 23:07:13.152 [notice] Tor can't help you if you use it wrong! Learn how to be safe at https://www.torproject.org/download/download#warning
Nov 12 23:07:13.165 [notice] Read configuration file "D:\PROGRAMS\tor\Tor\torrc".
Nov 12 23:07:13.174 [notice] Opening Socks listener on
Nov 12 23:07:13.174 [notice] Opening Control listener on
Nov 12 23:07:13.174 [notice] Opening OR listener on
Nov 12 23:07:13.000 [notice] Parsing GEOIP IPv4 file D:\PROGRAMS\tor\Data\Tor\geoip.
Nov 12 23:07:13.000 [notice] Parsing GEOIP IPv6 file D:\PROGRAMS\tor\Data\Tor\geoip6.
Nov 12 23:07:13.000 [notice] Configured to measure statistics. Look for the *-stats files that will first be written to the data directory in 24 hours from now.
Nov 12 23:07:13.000 [notice] Your Tor server's identity key fingerprint is 'ididntedittheconfig xxx'
Nov 12 23:07:13.000 [notice] Bootstrapped 0%: Starting
Nov 12 23:07:14.000 [warn] Please upgrade! This version of Tor ( is not recommended, according to the directory authorities. Recommended versions are:,,,,,
Nov 12 23:07:39.000 [notice] Bootstrapped 80%: Connecting to the Tor network
Nov 12 23:08:05.000 [notice] Bootstrapped 85%: Finishing handshake with first hop
Nov 12 23:08:05.000 [notice] Guessed our IP address as xx.xx.xx.xx (source:
Nov 12 23:08:07.000 [notice] Bootstrapped 90%: Establishing a Tor circuit
Nov 12 23:08:08.000 [notice] Tor has successfully opened a circuit. Looks like client functionality is working.
Nov 12 23:08:08.000 [notice] Bootstrapped 100%: Done
Nov 12 23:08:08.000 [notice] Now checking whether ORPort xx.xx.xx.xx:9001 is reachable... (this may take up to 20 minutes -- look for log messages indicating success)
Nov 12 23:08:50.000 [warn] Failure from drain_fd: No error
Nov 12 23:14:15.000 [notice] Your network connection speed appears to have changed. Resetting timeout to 60s after 18 timeouts and 101 buildtimes.
Nov 12 23:28:05.000 [warn] Your server (xx.xx.xx.xx:9001) has not managed to confirm that its ORPort is reachable. Relays do not publish descriptors until their ORPort and DirPort are reachable. Please check your firewalls, ports, address, /etc/hosts file, etc.
Nov 12 23:28:46.000 [notice] No circuits are opened. Relaxed timeout for circuit 1162 (a Measuring circuit timeout 3-hop circuit in state doing handshakes with channel state open) to 60000ms. However, it appears the circuit has timed out anyway. 1 guards are live.


DataDirectory D:\PROGRAMS\tor\Data\Tor
GeoIPFile D:\PROGRAMS\tor\Data\Tor\geoip
GeoIPv6File D:\PROGRAMS\tor\Data\Tor\geoip6
HiddenServiceStatistics 0

#-=- relay -=-#

ORPort 9001
Exitpolicy reject *:*
Nickname ididntedittheconfig
ContactInfo human@human.hu
RelayBandwidthRate 500 KBytes
RelayBandwidthBurst 1 MBytes

#=-= other =-=#

MaxMemInQueues 512 MB
SOCKSPort 9050
ControlPort 9051
HashedControlPassword 16:xxxx

Log notice file D:\PROGRAMS\tor\Data\Tor\tor.log
  • You may be interesting in trying tor-fw-helper with the PortForwardingHelper option and PortFowarding set to 1. It may also be that your ISP is blocking port 9001, you could try using a different port. – cacahuatl Nov 14 '16 at 2:08
  • I've checked that ISP is not blocking any ports. Opened port for utorrent in router, and checked that it's open, and then tried to use it with tor. But it's like tor is not answering on the ORPort assigned in config. – Sly Nov 14 '16 at 22:07
  • Local router then? It's likely that your torrent program is using UPNP or similar to negotiate opening the port, this is what the tor-fw-helper will do for you. – cacahuatl Nov 16 '16 at 1:16
  • And where do I get this helper for Windows 7? – Sly Nov 16 '16 at 23:21
  • Are you forwarding the port for TCP? Torrents only need UDP ports, but Tor uses TCP. Check to see if the forwarded port is using TCP or TCP/UDP. – SuperSluether Nov 17 '16 at 2:17

Prolem was solved with the help of some commenters by using tor forward helper tool. It forwards ports appropriately on the internal windows router. For that I downloaded go language builder, installed it, and build tor-fw-helper tool from source. After that one need to add to torrc two directives:

PortForwarding 1
PortForwardingHelper [path-to]\tor-fw-helper.exe

Originally torrc configures you listening on localhost so change listen address to global or LAN IP 192.168.1.XXX in /etc/tor/torrc.

Relay config:

#ORPort 443 <-- Make sure to comment this line out!
ORPort 443 NoListen
ORPort NoAdvertise

[DirPort optional]

#DirPort 80 <-- Make sure to comment this line out!
DirPort 80 NoListen
DirPort NoAdvertise

Bridge config: Then for testing purposes, you would enter obfs4 port 443. Watch out! Test fails when run from the same device you are running Tor Bridge on.

#ORPort 80 <-- Make sure to comment this line out!
ORPort 80 NoListen
ORPort NoAdvertise
ServerTransportPlugin obfs4 exec /usr/bin/obfs4proxy
ServerTransportListenAddr obfs4
ExtORPort auto

Tighten it: Local port 99999 reachable from LAN, listening for incoming connections from router. Router listening on = ORPort reachable from WAN. Possible TCP backdoor closed.

#ORPort 443 <-- Make sure to comment this line out!
ORPort 443 NoListen
ORPort 192.168.100:9999 NoAdvertise # Notice LAN address

If you are running a httpd web server: Forward a random WAN port to local port 80. That done, let people know they have to access a web server on your network like this now: XXX.XXX.X.XXX:8000

DIY Portforwarding:

1. Find out which router you have and ho to log into it. Read the documentation for your specific router. For Asus. Asus specifically states that i need to give my computer a Manual(static) IP address to portforward.

2. Make your IP static from the computers side. "Preferred DNS server" will be your routers LAN IP, for asus is the one.

For purpose of above examples: Say i portforwarded like this, External 443 -> Local 99999 and External 80 -> Local 22222, where External port = on your router (WAN port), and, Local port = on your computer.

Listening globally is already default on the router. So configure your torrc like under the heading Tighten it.(For asus, default listening would be changed by filling in the Source IP input field, e.g. would make port listen only for connections from - (/24 for the first 3x8 bits must be identical).

Dont worry, this is safe. Like this port 80 and 443 wont actually be standing open on your computer and your router should have default setting 'WAN config' disabled. [Asus: Administration>System>Remote Access Config>Enable Web Access from WAN=NO].

Of course you could however forward external port 443 to local port 443, and 80 to 80. But TLS protocol is configured to send your computers standard certificates on port 80 and 443. Tor genereates special Tor certificates verified by Tor Directory Authorities for TLS handshake.

Make sure to build yourself a good portscanner to calm your paranoia in times of need with youtube instructions from DRAPS TV [Hint: optparse is depreceated since python3.2, use argparse]

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.