I have Tor expert bundle v0.2.8.7. I'm trying to configure a relay under Windows 7. After a day of work the relay is still not reachable:

Nov 13 20:08:14.000 [warn] Your server (xx.xx.xx.xx:9001) has not managed to confirm that its ORPort is reachable. Relays do not publish descriptors until their ORPort and DirPort are reachable. Please check your firewalls, ports, address, /etc/hosts file, etc.

I've checked Windows firewall, all connections are allowed. Port 9001 on my router is also opened. I've checked that I'm correctly opening port on my router using utorrent. I've opened port 43634 for it, and it works.

The thing is that when I'm trying to check if port is opened with any online checker, checker says that utorrent port 43634 is "open", and tor port 9001 is "closed", even when Tor is running.

But still Tor works as proxy, and connecting to tor network.

Nov 12 23:07:13.000 [notice] Tor (git-263088633a63982a) opening log file.
Nov 12 23:07:13.148 [notice] Tor v0.2.8.7 (git-263088633a63982a) running on Windows 7 with Libevent 2.0.22-stable, OpenSSL 1.0.1t and Zlib 1.2.8.
Nov 12 23:07:13.152 [notice] Tor can't help you if you use it wrong! Learn how to be safe at https://www.torproject.org/download/download#warning
Nov 12 23:07:13.165 [notice] Read configuration file "D:\PROGRAMS\tor\Tor\torrc".
Nov 12 23:07:13.174 [notice] Opening Socks listener on
Nov 12 23:07:13.174 [notice] Opening Control listener on
Nov 12 23:07:13.174 [notice] Opening OR listener on
Nov 12 23:07:13.000 [notice] Parsing GEOIP IPv4 file D:\PROGRAMS\tor\Data\Tor\geoip.
Nov 12 23:07:13.000 [notice] Parsing GEOIP IPv6 file D:\PROGRAMS\tor\Data\Tor\geoip6.
Nov 12 23:07:13.000 [notice] Configured to measure statistics. Look for the *-stats files that will first be written to the data directory in 24 hours from now.
Nov 12 23:07:13.000 [notice] Your Tor server's identity key fingerprint is 'ididntedittheconfig xxx'
Nov 12 23:07:13.000 [notice] Bootstrapped 0%: Starting
Nov 12 23:07:14.000 [warn] Please upgrade! This version of Tor ( is not recommended, according to the directory authorities. Recommended versions are:,,,,,
Nov 12 23:07:39.000 [notice] Bootstrapped 80%: Connecting to the Tor network
Nov 12 23:08:05.000 [notice] Bootstrapped 85%: Finishing handshake with first hop
Nov 12 23:08:05.000 [notice] Guessed our IP address as xx.xx.xx.xx (source:
Nov 12 23:08:07.000 [notice] Bootstrapped 90%: Establishing a Tor circuit
Nov 12 23:08:08.000 [notice] Tor has successfully opened a circuit. Looks like client functionality is working.
Nov 12 23:08:08.000 [notice] Bootstrapped 100%: Done
Nov 12 23:08:08.000 [notice] Now checking whether ORPort xx.xx.xx.xx:9001 is reachable... (this may take up to 20 minutes -- look for log messages indicating success)
Nov 12 23:08:50.000 [warn] Failure from drain_fd: No error
Nov 12 23:14:15.000 [notice] Your network connection speed appears to have changed. Resetting timeout to 60s after 18 timeouts and 101 buildtimes.
Nov 12 23:28:05.000 [warn] Your server (xx.xx.xx.xx:9001) has not managed to confirm that its ORPort is reachable. Relays do not publish descriptors until their ORPort and DirPort are reachable. Please check your firewalls, ports, address, /etc/hosts file, etc.
Nov 12 23:28:46.000 [notice] No circuits are opened. Relaxed timeout for circuit 1162 (a Measuring circuit timeout 3-hop circuit in state doing handshakes with channel state open) to 60000ms. However, it appears the circuit has timed out anyway. 1 guards are live.


DataDirectory D:\PROGRAMS\tor\Data\Tor
GeoIPFile D:\PROGRAMS\tor\Data\Tor\geoip
GeoIPv6File D:\PROGRAMS\tor\Data\Tor\geoip6
HiddenServiceStatistics 0

#-=- relay -=-#

ORPort 9001
Exitpolicy reject *:*
Nickname ididntedittheconfig
ContactInfo human@human.hu
RelayBandwidthRate 500 KBytes
RelayBandwidthBurst 1 MBytes

#=-= other =-=#

MaxMemInQueues 512 MB
SOCKSPort 9050
ControlPort 9051
HashedControlPassword 16:xxxx

Log notice file D:\PROGRAMS\tor\Data\Tor\tor.log
  • You may be interesting in trying tor-fw-helper with the PortForwardingHelper option and PortFowarding set to 1. It may also be that your ISP is blocking port 9001, you could try using a different port. – cacahuatl Nov 14 '16 at 2:08
  • I've checked that ISP is not blocking any ports. Opened port for utorrent in router, and checked that it's open, and then tried to use it with tor. But it's like tor is not answering on the ORPort assigned in config. – Sly Nov 14 '16 at 22:07
  • Local router then? It's likely that your torrent program is using UPNP or similar to negotiate opening the port, this is what the tor-fw-helper will do for you. – cacahuatl Nov 16 '16 at 1:16
  • And where do I get this helper for Windows 7? – Sly Nov 16 '16 at 23:21
  • Are you forwarding the port for TCP? Torrents only need UDP ports, but Tor uses TCP. Check to see if the forwarded port is using TCP or TCP/UDP. – SuperSluether Nov 17 '16 at 2:17

Prolem was solved with the help of some commenters by using tor forward helper tool. It forwards ports appropriately on the internal windows router. For that I downloaded go language builder, installed it, and build tor-fw-helper tool from source. After that one need to add to torrc two directives:

PortForwarding 1
PortForwardingHelper [path-to]\tor-fw-helper.exe

...or DIY portforward

Find out which router you have. Log into it. For example I have asus, so i visit: http://router.asus.com/

Read the documentation for your specific router. If you have asus: https://www.asus.com/us/support/FAQ/114093/

Asus specifically states that i need to give my computer a static IP address to portforward for example.

For this answer: External port = on your router, and, Local port = on your computer.

Then portforward external 443 to some random local port on your computer. And portforward external 80 to some other random local port. Make sure to forward BOTH protocols on port 80 (UDP aswell)...DNS uses both protocols for certification so some lag time verifying when they come from different ports when you are doing your normal browsing later.

Dont worry, this is safe, port 80 wont actually be standing open because it is portforwarded. Make sure to build your self a good portscanner with instructions from my yoda DRAPS TV [Hint: optparse is depreceated since python3.2, use argparse]

If you are running a httpd web server, like Apache2: Unless someone on your network is running a server accessed by HTTP protocol, which defaults to sending requests to port 80, then forwarding port 80 doesnt change anything. If you are running one, make sure to chose a random external port, e.g. 8000, and port forward it to local port 80 (or the port which e.g. apache2 is configured to listen on...if you are smart you changed it). That done you have to let people know on that they need to enter the port number along with the public IP address to access any HTTP server on your network now, e.g.: XXX.XXX.X.XXX:8000

Of course you can forward external port 443 to local port 443, and 80 to 80. Then however, these ports which bots so frequently scan, are standing open. I guess if you are using Ethernet cable, you dont need to do any port forwarding?

If you did follow my advice to switcheroo, you need change listen address from localhost to global or LAN IP 192.168.1.XXX in the /etc/tor/torrc file:

For the purpose of this tutorial, say i portforwarded like this: 443 -> 99999 and 80 -> 22222


ORPort 443
ORPort 443 NoListen
ORPort NoAdvertise

[DirPort optional]

DirPort 80 
DirPort 80 NoListen
DirPort NoAdvertise

Global listen address can however be replaced with your local IP (e.g. Because of this portforwarding, your router will be listening globally making your tor ports reachable for the outside world (...unless you limit it. For asus this would be done by writing something in the Source IP input field, e.g. would make the router only listen for connections from a LAN address e.g. (24 for the first 3x8 bits must be identical)).

It's safer to listen locally, or limit your routers listening on the ports 99999 and 22222.

ORPort 443
ORPort 443 NoListen
ORPort **192.168.100**:9999 NoAdvertise

e.g....then local port 99999 only listens for incoming connections via ORPort 443 when tor is running, and no connection from outside LAN can connect directly to open 99999.


ORPort 80
ORPort 80 NoListen
ORPort NoAdvertise
ServerTransportPlugin obfs4 exec /usr/bin/obfs4proxy
ServerTransportListenAddr obfs4
ExtORPort auto

Then for testing purposes, you would enter obfs4 port 443. Achtung! Test fails when run from the same device you are running tor bridge on.

New contributor
6666 is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.