tor-webwml.git

docs/en/tor-doc-server.wml   1) ## translation metadata
docs/en/tor-doc-server.wml   2) # Revision: $Revision$

docs/en/tor-doc-relay.wml    3) # Translation-Priority: 2-medium

docs/en/tor-doc-server.wml   4) 

docs/en/tor-doc-relay.wml    5) #include "head.wmi" TITLE="Tor: Relay Configuration Instructions" CHARSET="UTF-8"

docs/en/tor-doc-server.wml   6) 
docs/en/tor-doc-server.wml   7) <div class="center">
docs/en/tor-doc-server.wml   8) 
docs/en/tor-doc-server.wml   9) <div class="main-column">
docs/en/tor-doc-server.wml  10) 

docs/en/tor-doc-relay.wml   11) <h1>Configuring a Tor relay</h1>
docs/en/tor-doc-relay.wml   12) 
docs/en/tor-doc-relay.wml   13) <!-- BEGIN SIDEBAR -->
docs/en/tor-doc-relay.wml   14) <div class="sidebar-left">
docs/en/tor-doc-relay.wml   15) <h3>Config Steps</h3>
docs/en/tor-doc-relay.wml   16) <ol>

docs/en/tor-doc-relay.wml   17) <li><a href="<page docs/tor-doc-relay>#install">Download &amp; Install</a></li>

docs/en/tor-doc-relay.wml   18) <li><a href="<page docs/tor-doc-relay>#setup">Configuration</a></li>

docs/en/tor-doc-relay.wml   19) <li><a href="<page docs/tor-doc-relay>#check">Check &amp; Confirm</a></li>

docs/en/tor-doc-relay.wml   20) <li><a href="<page docs/tor-doc-relay>#after">Final Steps</a></li>
docs/en/tor-doc-relay.wml   21) </ol>
docs/en/tor-doc-relay.wml   22) </div>
docs/en/tor-doc-relay.wml   23) <!-- END SIDEBAR -->
docs/en/tor-doc-relay.wml   24) 
docs/en/tor-doc-relay.wml   25) <hr />

docs/en/tor-doc-server.wml  26) 
docs/en/tor-doc-server.wml  27) <p>
docs/en/tor-doc-server.wml  28) The Tor network relies on volunteers to donate bandwidth. The more

docs/en/tor-doc-relay.wml   29) people who run relays, the faster the Tor network will be. If you have

docs/en/tor-doc-server.wml  30) at least 20 kilobytes/s each way, please help out Tor by configuring your

docs/en/tor-doc-relay.wml   31) Tor to be a relay too. We have many features that make Tor relays easy

docs/en/tor-doc-relay.wml   32) and convenient, including <a href="<page faq>#RelayFlexible">rate limiting
docs/en/tor-doc-relay.wml   33) for bandwidth, exit policies so you can limit your exposure to abuse
docs/en/tor-doc-relay.wml   34) complaints, and support for dynamic IP addresses</a>.
docs/en/tor-doc-relay.wml   35) </p>

docs/en/tor-doc-server.wml  36) 

docs/en/tor-doc-relay.wml   37) <p>You can run a Tor relay on <a
docs/en/tor-doc-relay.wml   38) href="https://wiki.torproject.org/noreply/TheOnionRouter/TorFAQ#RelayOS">pretty

docs/en/tor-doc-relay.wml   39) much any</a> operating system. Tor relays work best on Linux, OS X Tiger
docs/en/tor-doc-relay.wml   40) or later, FreeBSD 5.x+, NetBSD 5.x+, and Windows Server 2003 or later.

docs/en/tor-doc-relay.wml   41) </p>

docs/en/tor-doc-server.wml  42) 
docs/en/tor-doc-server.wml  43) <hr />

docs/en/tor-doc-relay.wml   44) <a id="zero"></a>

docs/en/tor-doc-relay.wml   45) <a id="install"></a>
docs/en/tor-doc-relay.wml   46) <h2><a class="anchor" href="#install">Step One: Download and Install Tor</a></h2>

docs/en/tor-doc-server.wml  47) <br />
docs/en/tor-doc-server.wml  48) 
docs/en/tor-doc-server.wml  49) <p>Before you start, you need to make sure that Tor is up and running.
docs/en/tor-doc-server.wml  50) </p>
docs/en/tor-doc-server.wml  51) 

docs/en/tor-doc-relay.wml   52) <p>Visit our <a href="<page easy-download>">download page</a> and
docs/en/tor-doc-relay.wml   53) install the "Installation Bundle" for your OS.

docs/en/tor-doc-server.wml  54) </p>

docs/en/tor-doc-relay.wml   55) 

docs/en/tor-doc-server.wml  56) <p>If it's convenient, you might also want to use it as a client for a
docs/en/tor-doc-server.wml  57) while to make sure it's actually working.</p>
docs/en/tor-doc-server.wml  58) 
docs/en/tor-doc-server.wml  59) <hr />

docs/en/tor-doc-server.wml  60) <a id="setup"></a>

docs/en/tor-doc-relay.wml   61) <h2><a class="anchor" href="#setup">Step Two: Set it up as a relay</a></h2>

docs/en/tor-doc-server.wml  62) <br />

docs/en/tor-doc-relay.wml   63) <ol>

docs/en/tor-doc-relay.wml   64) <li>Verify that your clock and timezone are set
docs/en/tor-doc-relay.wml   65) correctly. If possible, synchronize your clock with public <a
docs/en/tor-doc-relay.wml   66) href="http://en.wikipedia.org/wiki/Network_Time_Protocol">time
docs/en/tor-doc-relay.wml   67) servers</a>.

docs/en/tor-doc-relay.wml   68) </li>

docs/en/tor-doc-server.wml  69) 

docs/en/tor-doc-relay.wml   70) <li><strong>Configuring Tor with the Vidalia Graphical Interface</strong>:

docs/en/tor-doc-relay.wml   71) <ol>

docs/en/tor-doc-relay.wml   72) 
docs/en/tor-doc-relay.wml   73) <li>
docs/en/tor-doc-relay.wml   74) 	<dt>Right click on the Vidalia icon in your task bar.  Choose <tt>Control Panel</tt>.</dt>
docs/en/tor-doc-relay.wml   75) 	<dd><img src="../img/screenshot-win32-vidalia.png"></dd>
docs/en/tor-doc-relay.wml   76) </li>
docs/en/tor-doc-relay.wml   77) 

docs/en/tor-doc-relay.wml   78) <li>Click <tt>Setup Relaying</tt>.</li>

docs/en/tor-doc-relay.wml   79) 
docs/en/tor-doc-relay.wml   80) <li>
docs/en/tor-doc-relay.wml   81) 	<dt>Choose <tt>Relay Traffic for the Tor network</tt> if you want to be a public relay (recommended), or choose 		<tt>Help censored users reach the Tor network</tt> if you want to be a <a href="<page faq>#RelayOrBridge">bridge</a> for users in countries that censor their Internet.</dt>
docs/en/tor-doc-relay.wml   82) <dd><img src="../img/screenshot-win32-configure-relay-1.png"></dd>
docs/en/tor-doc-relay.wml   83) </li>
docs/en/tor-doc-relay.wml   84) 

docs/en/tor-doc-relay.wml   85) <li>Enter a nickname for your relay, and enter contact information in
docs/en/tor-doc-relay.wml   86) case we need to contact you about problems.</li>

docs/en/tor-doc-relay.wml   87) 

docs/en/tor-doc-relay.wml   88) <li>Leave <tt>Attempt to automatically configure port forwarding</tt> clicked.

docs/en/tor-doc-relay.wml   89) Push the <tt>Test</tt> button to see if it works.  If it does work, great.

docs/en/tor-doc-relay.wml   90) If not, see number 3 below.</li>

docs/en/tor-doc-relay.wml   91) 
docs/en/tor-doc-relay.wml   92) <li><dt>Choose the <tt>Bandwidth Limits</tt> tab.  Select how much bandwidth you want to provide for Tor users like yourself.</dt>
docs/en/tor-doc-relay.wml   93) <dd><img src="../img/screenshot-win32-configure-relay-2.png"></dd>
docs/en/tor-doc-relay.wml   94) </li> 
docs/en/tor-doc-relay.wml   95) 
docs/en/tor-doc-relay.wml   96) <li><dt>Choose the <tt>Exit Policies</tt> tab.  If you want to allow others

docs/en/tor-doc-relay.wml   97) to use your relay for these services, don't change anything.  Un-check

docs/en/tor-doc-relay.wml   98) the services you don't want to allow people to <a href="<page

docs/en/tor-doc-relay.wml   99) faq>#ExitPolicies">reach from your relay</a>.  If you want to be a non-exit relay, un-check all services.</dt>
docs/en/tor-doc-relay.wml  100) <dd><img src="../img/screenshot-win32-configure-relay-3.png"></dd>
docs/en/tor-doc-relay.wml  101) </li>
docs/en/tor-doc-relay.wml  102) 

docs/en/tor-doc-relay.wml  103) <li>Click the <tt>Ok</tt> button.  See Step Three below for confirmation

docs/en/tor-doc-relay.wml  104) that the relay is working correctly.</li>

docs/en/tor-doc-relay.wml  105) </ol>

docs/en/tor-doc-server.wml 106) 

docs/en/tor-doc-relay.wml  107) <br />

docs/en/tor-doc-relay.wml  108) <strong>Manual Configuration</strong>:

docs/en/tor-doc-relay.wml  109) <ul>

docs/en/tor-doc-relay.wml  110) <li>Edit the bottom part of <a
docs/en/tor-doc-relay.wml  111) href="https://wiki.torproject.org/noreply/TheOnionRouter/TorFAQ#torrc">your

docs/en/tor-doc-relay.wml  112) torrc file</a>. If you want to be a public relay (recommended),
docs/en/tor-doc-relay.wml  113) make sure to define ORPort and <a href="<page
docs/en/tor-doc-relay.wml  114) faq>#ExitPolicies">look at ExitPolicy</a>; otherwise
docs/en/tor-doc-relay.wml  115) if you want to be a <a href="<page faq>#RelayOrBridge">bridge</a>
docs/en/tor-doc-relay.wml  116) for users in countries that censor their Internet,
docs/en/tor-doc-relay.wml  117) just use <a href="<page bridges>#RunningABridge">these lines</a>.

docs/en/tor-doc-relay.wml  118) </li>

docs/en/tor-doc-server.wml 119) 

docs/en/tor-doc-relay.wml  120) </ul></li>

docs/en/tor-doc-relay.wml  121) 

docs/en/tor-doc-relay.wml  122) <li>If you are using a firewall, open a hole in your firewall
docs/en/tor-doc-relay.wml  123) so incoming connections can reach the ports you configured
docs/en/tor-doc-relay.wml  124) (ORPort, plus DirPort if you enabled it). If you have a
docs/en/tor-doc-relay.wml  125) hardware firewall (Linksys box, cablemodem, etc) you might like <a
docs/en/tor-doc-relay.wml  126) href="http://portforward.com/">portforward.com</a>. Also, make sure you

docs/en/tor-doc-relay.wml  127) allow all <em>outgoing</em> connections too, so your relay can reach the

docs/en/tor-doc-relay.wml  128) other Tor relays.

docs/en/tor-doc-relay.wml  129) </li>

docs/en/tor-doc-server.wml 130) 

docs/en/tor-doc-relay.wml  131) <li>Restart your relay. If it <a

docs/en/tor-doc-relay.wml  132) href="https://wiki.torproject.org/noreply/TheOnionRouter/TorFAQ#Logs">logs

docs/en/tor-doc-server.wml 133) any warnings</a>, address them.

docs/en/tor-doc-relay.wml  134) </li>

docs/en/tor-doc-server.wml 135) 

docs/en/tor-doc-relay.wml  136) <li>Subscribe to the <a

docs/en/tor-doc-server.wml 137) href="http://archives.seul.org/or/announce/">or-announce</a>
docs/en/tor-doc-server.wml 138) mailing list. It is very low volume, and it will keep you informed
docs/en/tor-doc-server.wml 139) of new stable releases. You might also consider subscribing to <a

docs/en/tor-doc-relay.wml  140) href="<page documentation>#MailingLists">the higher-volume Tor lists</a>
docs/en/tor-doc-relay.wml  141) too.

docs/en/tor-doc-relay.wml  142) </li>

docs/en/tor-doc-server.wml 143) 

docs/en/tor-doc-relay.wml  144) </ol>

docs/en/tor-doc-server.wml 145) 
docs/en/tor-doc-server.wml 146) <hr />

docs/en/tor-doc-server.wml 147) <a id="check"></a>

docs/en/tor-doc-relay.wml  148) <h2><a class="anchor" href="#check">Step Three: Make sure it is working</a></h2>

docs/en/tor-doc-server.wml 149) <br />
docs/en/tor-doc-server.wml 150) 

docs/en/tor-doc-relay.wml  151) <p>As soon as your relay manages to connect to the network, it will

docs/en/tor-doc-server.wml 152) try to determine whether the ports you configured are reachable from

docs/en/tor-doc-relay.wml  153) the outside. This step is usually fast, but may take up to 20
docs/en/tor-doc-relay.wml  154) minutes. Look for a

docs/en/tor-doc-relay.wml  155) <a href="https://wiki.torproject.org/noreply/TheOnionRouter/TorFAQ#Logs">log

docs/en/tor-doc-server.wml 156) entry</a> like

docs/en/tor-doc-server.wml 157) <tt>Self-testing indicates your ORPort is reachable from the outside. Excellent.</tt>

docs/en/tor-doc-relay.wml  158) If you don't see this message, it means that your relay is not reachable

docs/en/tor-doc-server.wml 159) from the outside — you should re-check your firewalls, check that it's
docs/en/tor-doc-server.wml 160) testing the IP and port you think it should be testing, etc.
docs/en/tor-doc-server.wml 161) </p>
docs/en/tor-doc-server.wml 162) 
docs/en/tor-doc-server.wml 163) <p>When it decides that it's reachable, it will upload a "server

docs/en/tor-doc-relay.wml  164) descriptor" to the directories, to let clients know

docs/en/tor-doc-relay.wml  165) what address, ports, keys, etc your relay is using. You can <a

docs/en/tor-doc-server.wml 166) href="http://moria.seul.org:9032/tor/status/authority">load one of
docs/en/tor-doc-server.wml 167) the network statuses manually</a> and

docs/en/tor-doc-server.wml 168) look through it to find the nickname you configured, to make sure it's
docs/en/tor-doc-server.wml 169) there. You may need to wait a few seconds to give enough time for it to
docs/en/tor-doc-server.wml 170) make a fresh directory.</p>
docs/en/tor-doc-server.wml 171) 
docs/en/tor-doc-server.wml 172) <hr />

docs/en/tor-doc-server.wml 173) <a id="after"></a>

docs/en/tor-doc-relay.wml  174) <h2><a class="anchor" href="#after">Step Four: Once it is working</a></h2>

docs/en/tor-doc-server.wml 175) <br />
docs/en/tor-doc-server.wml 176) 
docs/en/tor-doc-server.wml 177) <p>

docs/en/tor-doc-server.wml 178) We recommend the following steps as well:

docs/en/tor-doc-server.wml 179) </p>
docs/en/tor-doc-server.wml 180) 
docs/en/tor-doc-server.wml 181) <p>

docs/en/tor-doc-relay.wml  182) 6. Read
docs/en/tor-doc-relay.wml  183) <a href="https://wiki.torproject.org/noreply/TheOnionRouter/OperationalSecurity">about operational security</a>

docs/en/tor-doc-relay.wml  184) to get ideas how you can increase the security of your relay.

docs/en/tor-doc-server.wml 185) </p>
docs/en/tor-doc-server.wml 186) 
docs/en/tor-doc-server.wml 187) <p>

docs/en/tor-doc-relay.wml  188) 7. If you want to run more than one relay that's great, but please set <a

docs/en/tor-doc-relay.wml  189) href="https://wiki.torproject.org/noreply/TheOnionRouter/TorFAQ#MultipleRelays">the
docs/en/tor-doc-relay.wml  190) MyFamily option</a> in all your relays' configuration files.

docs/en/tor-doc-server.wml 191) </p>
docs/en/tor-doc-server.wml 192) 
docs/en/tor-doc-server.wml 193) <p>

docs/en/tor-doc-relay.wml  194) 8. Decide about rate limiting. Cable modem, DSL, and other users

docs/en/tor-doc-server.wml 195) who have asymmetric bandwidth (e.g. more down than up) should
docs/en/tor-doc-server.wml 196) rate limit to their slower bandwidth, to avoid congestion. See the <a

docs/en/tor-doc-relay.wml  197) href="https://wiki.torproject.org/noreply/TheOnionRouter/TorFAQ#LimitBandwidth">rate

docs/en/tor-doc-server.wml 198) limiting FAQ entry</a> for details.
docs/en/tor-doc-server.wml 199) </p>
docs/en/tor-doc-server.wml 200) 
docs/en/tor-doc-server.wml 201) <p>

docs/en/tor-doc-relay.wml  202) 9. Back up your Tor relay's private key (stored in "keys/secret_id_key"

docs/en/tor-doc-relay.wml  203) in your DataDirectory). This is your relay's "identity," and

docs/en/tor-doc-server.wml 204) you need to keep it safe so nobody can read the traffic that goes

docs/en/tor-doc-relay.wml  205) through your relay. This is the critical file to keep if you need to <a

docs/en/tor-doc-relay.wml  206) href="https://wiki.torproject.org/noreply/TheOnionRouter/TorFAQ#UpgradeRelay">move

docs/en/tor-doc-relay.wml  207) or restore your Tor relay</a> if something goes wrong.

docs/en/tor-doc-server.wml 208) </p>
docs/en/tor-doc-server.wml 209) 
docs/en/tor-doc-server.wml 210) <p>

docs/en/tor-doc-relay.wml  211) 

docs/en/tor-doc-relay.wml  212) 10. If you control the name servers for your domain, consider setting your

docs/en/tor-doc-relay.wml  213) reverse DNS hostname to 'anonymous-relay', 'proxy' or 'tor-proxy', so when
docs/en/tor-doc-relay.wml  214) other people see the address in their web logs, they will more quickly
docs/en/tor-doc-relay.wml  215) understand what's going on. Adding the <a

docs/en/tor-doc-relay.wml  216) href="<gitblob>contrib/tor-exit-notice.html">Tor

docs/en/tor-doc-relay.wml  217) exit notice</a> on a vhost for this name can go a long way to deterring abuse
docs/en/tor-doc-relay.wml  218) complaints to you and your ISP if you are running an exit node.
docs/en/tor-doc-relay.wml  219) 

docs/en/tor-doc-server.wml 220) </p>
docs/en/tor-doc-server.wml 221) 
docs/en/tor-doc-server.wml 222) <p>

docs/en/tor-doc-relay.wml  223) 11. If your computer isn't running a webserver, please consider

docs/en/tor-doc-server.wml 224) changing your ORPort to 443 and your DirPort to 80. Many Tor
docs/en/tor-doc-server.wml 225) users are stuck behind firewalls that only let them browse the

docs/en/tor-doc-relay.wml  226) web, and this change will let them reach your Tor relay. Win32
docs/en/tor-doc-relay.wml  227) relays can simply change their ORPort and DirPort directly
docs/en/tor-doc-relay.wml  228) in their torrc and restart Tor. OS X or Unix relays can't bind

docs/en/tor-doc-server.wml 229) directly to these ports (since they don't run as root), so they will
docs/en/tor-doc-server.wml 230) need to set up some sort of <a

docs/en/tor-doc-relay.wml  231) href="https://wiki.torproject.org/noreply/TheOnionRouter/TorFAQ#ServerForFirewalledClients">

docs/en/tor-doc-relay.wml  232) port forwarding</a> so connections can reach their Tor relay. If you are

docs/en/tor-doc-server.wml 233) using ports 80 and 443 already but still want to help out, other useful
docs/en/tor-doc-server.wml 234) ports are 22, 110, and 143.
docs/en/tor-doc-server.wml 235) </p>
docs/en/tor-doc-server.wml 236) 
docs/en/tor-doc-server.wml 237) <p>

docs/en/tor-doc-relay.wml  238) 12. If your Tor relay provides other services on the same IP address

docs/en/tor-doc-server.wml 239) — such as a public webserver — make sure that connections to the
docs/en/tor-doc-server.wml 240) webserver are allowed from the local host too. You need to allow these

docs/en/tor-doc-relay.wml  241) connections because Tor clients will detect that your Tor relay is the <a

docs/en/tor-doc-relay.wml  242) href="https://wiki.torproject.org/noreply/TheOnionRouter/TorFAQ#ExitEavesdroppers">safest

docs/en/tor-doc-server.wml 243) way to reach that webserver</a>, and always build a circuit that ends

docs/en/tor-doc-relay.wml  244) at your relay. If you don't want to allow the connections, you must

docs/en/tor-doc-server.wml 245) explicitly reject them in your exit policy.
docs/en/tor-doc-server.wml 246) </p>
docs/en/tor-doc-server.wml 247) 
docs/en/tor-doc-server.wml 248) <p>

docs/en/tor-doc-relay.wml  249) 13. (Unix only). Make a separate user to run the relay. If you

docs/en/tor-doc-server.wml 250) installed the OS X package or the deb or the rpm, this is already

docs/en/tor-doc-relay.wml  251) done. Otherwise, you can do it by hand. (The Tor relay doesn't need to

docs/en/tor-doc-server.wml 252) be run as root, so it's good practice to not run it as root. Running
docs/en/tor-doc-server.wml 253) as a 'tor' user avoids issues with identd and other services that
docs/en/tor-doc-server.wml 254) detect user name. If you're the paranoid sort, feel free to <a

docs/en/tor-doc-relay.wml  255) href="https://wiki.torproject.org/noreply/TheOnionRouter/TorInChroot">put Tor

docs/en/tor-doc-server.wml 256) into a chroot jail</a>.)
docs/en/tor-doc-server.wml 257) </p>
docs/en/tor-doc-server.wml 258) 
docs/en/tor-doc-server.wml 259) <p>

docs/en/tor-doc-relay.wml  260) 14. (Unix only.) Your operating system probably limits the number

docs/en/tor-doc-server.wml 261) of open file descriptors per process to 1024 (or even less). If you
docs/en/tor-doc-server.wml 262) plan to be running a fast exit node, this is probably not enough. On
docs/en/tor-doc-server.wml 263) Linux, you should add a line like "toruser hard nofile 8192" to your
docs/en/tor-doc-server.wml 264) /etc/security/limits.conf file (where toruser is the user that runs the
docs/en/tor-doc-server.wml 265) Tor process), and then restart Tor if it's installed as a package (or log

docs/en/tor-doc-relay.wml  266) out and log back in if you run it yourself).

docs/en/tor-doc-server.wml 267) </p>
docs/en/tor-doc-server.wml 268) 
docs/en/tor-doc-server.wml 269) <p>

docs/en/tor-doc-relay.wml  270) 15. If you installed Tor via some package or installer, it probably starts

docs/en/tor-doc-server.wml 271) Tor for you automatically on boot. But if you installed from source,
docs/en/tor-doc-server.wml 272) you may find the initscripts in contrib/tor.sh or contrib/torctl useful.
docs/en/tor-doc-server.wml 273) </p>
docs/en/tor-doc-server.wml 274) 

docs/en/tor-doc-server.wml 275) <p>

docs/en/tor-doc-server.wml 276) When you change your Tor configuration, remember to verify that your

docs/en/tor-doc-relay.wml  277) relay still works correctly after the change. Be sure to set your

docs/en/tor-doc-server.wml 278) "ContactInfo" line in the torrc so we can contact you if you need to
docs/en/tor-doc-server.wml 279) upgrade or something goes wrong. If you have problems or questions, see
docs/en/tor-doc-server.wml 280) the <a href="<page documentation>#Support">Support</a> section or
docs/en/tor-doc-server.wml 281) <a href="<page contact>">contact us</a> on the tor-ops list. Thanks
docs/en/tor-doc-server.wml 282) for helping to make the Tor network grow!

docs/en/tor-doc-server.wml 283) </p>
docs/en/tor-doc-server.wml 284) 

docs/en/tor-doc-server.wml 285) <hr />
docs/en/tor-doc-server.wml 286) 

docs/en/tor-doc-server.wml 287) <p>If you have suggestions for improving this document, please <a
docs/en/tor-doc-server.wml 288) href="<page contact>">send them to us</a>. Thanks!</p>