I want to help censored users. How can I run an obfs4 (Pluggable Transport) bridge on a Debian-like GNU/Linux machine?

up vote 12 down vote accepted

Step 0: Follow this guide to setup the official package repository, and install Tor.

Step 1: Edit your sources.list to add obfs4proxy repository:

Note: you can skip this step if you're running Debian stable (jessie) or more recent.

deb http://deb.torproject.org/torproject.org obfs4proxy main

Step 2: Install obfs4proxy:

$ sudo apt-get update && sudo apt-get install obfs4proxy

Step 3: Edit your torrc config file, usually located at /etc/tor/torrc

#Bridge config
RunAsDaemon 1
ORPort 9001
BridgeRelay 1
ServerTransportPlugin obfs4 exec /usr/bin/obfs4proxy
ExtORPort auto
#set the Nickname and Contact info
ContactInfo <your-contact-info>
Nickname <pick-a-nickname>

Step 4: Restart Tor

$ sudo service tor restart

Step 5: Check the logs and confirm the ORPort is reachable and the obfs4proxy is working.

$ sudo tail -F /var/log/tor/log

You should see something like this:

[notice] Registered server transport 'obfs4' at '[::]:46396'
[notice] Tor has successfully opened a circuit. Looks like client functionality is working.
[notice] Bootstrapped 100%: Done
[notice] Now checking whether ORPort <redacted>:9001 is reachable... (this may take up to 20 minutes -- look for log messages indicating success)
[notice] Self-testing indicates your ORPort is reachable from the outside. Excellent. Publishing server descriptor.
  • I would argue for specifying a port number rather than using "auto". That way you know what to allow in your firewall settings. – user6943 Mar 16 '15 at 2:26
  • 4
    The "ExtORPort auto" above is fine -- the extended ORPort is for local connections, and you don't need to open anything in your external firewall. That said, if you want to pick your obfs4 port number, you could add a torrc line like "ServerTransportListenAddr obfs4 0.0.0.0:52812". But diversity of obfs4 ports is actually really important, so I'd argue against any instructions that will lead people to using the same port. – Roger Dingledine Apr 4 '15 at 19:50

Great explanation, it helped me a lot. Like to add the following; These days I do not see a lot of obfs4 traffic yet. If you want to publish as an obfs3 AND obfs4 bridge relay you can change the line

ServerTransportPlugin obfs4 exec /usr/bin/obfs4proxy

to

ServerTransportPlugin obfs3,obfs4 exec /usr/bin/obfs4proxy

You only need to install obfs4 as mentioned in the post above. obfs4 is backwards compatible with obfs3.

When you start up your bridge, you will see something like this in your logfile;

Registered server transport 'obfs3' at '[::]:41234'
Registered server transport 'obfs4' at '[::]:44321'

Leave your ExtORPort set to auto for diversity reasons. I have a firewall enabled on my Debian bridge with very restrictive port settings. I had to make port forwards for the given obfs ports in iptables (easy with gufw) as well as in my hardware (internet-)firewall to make things work. So I am not so sure that the ExORPort is for local connections only as mentioned by Rodger (please let me know if I am wrong here). The obfs3 and obfs4 transport ports Tor chooses for you will be cached, so after booting your bridge you keep the same ports. Hope this helps.

Tor needs bridges, be a bridge if you can!

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.