tor-webwml.git

1) ## translation metadata

2) # Revision: $Revision$

3) # Translation-Priority: 2-medium
4) 
5) #include "head.wmi" TITLE="Tor Project: Relay Configuration Instructions" CHARSET="UTF-8"
6) <div id="content" class="clearfix">
7)   <div id="breadcrumbs">

8)     <a href="<page index>">Home &raquo; </a>

9)     <a href="<page docs/documentation>">Documentation &raquo; </a>
10)     <a href="<page docs/tor-doc-relay>">Configure Tor Relay</a>

11)   </div>
12)   <div id="maincol">

13) 
14)     <h1>Configuring a Tor relay</h1>

15) 

16)     <hr>

17) 

18)     <p>
19)     The Tor network relies on volunteers to donate bandwidth. The more
20)     people who run relays, the faster the Tor network will be. If you have

21)     at least 50 kilobytes/s each way, please help out Tor by configuring your

22)     Tor to be a relay too.

23)     </p>

24) 

25)     <p>You can run a Tor relay on pretty much any operating system. Tor relays
26)     work best on Linux, OS X Tiger or later, FreeBSD 5.x+, NetBSD 5.x+, and
27)     Windows Server 2003 or later.

28)     </p>

29) 

30)     <p>If you're comfortable editing text files, skip this page and
31)     go to our dedicated <a href="<page docs/tor-relay-debian>">Relay
32)     Configuration Instructions on Debian/Ubuntu</a> page. That page is
33)     the best one for relay operators on BSD, Unix, etc as well.</p>
34) 

35)     <hr>

36)     <a id="zero"></a>
37)     <a id="install"></a>
38)     <h2><a class="anchor" href="#install">Step One: Download and Install Tor</a></h2>

39)     <br>

40) 

41)     <p>Before you start, you need to make sure that Tor is up and running.
42)     </p>

43) 

44)     <p>Visit our <a href="<page download/download>">download page</a> and

45)     install the "Installation Bundle" for your OS.
46)     </p>

47) 

48)     <p>If it's convenient, you might also want to use it as a client for a
49)     while to make sure it's actually working.</p>

50) 

51)     <hr>

52)     <a id="setup"></a>
53)     <h2><a class="anchor" href="#setup">Step Two: Set it up as a relay</a></h2>

54)     <br>

55)     <ol>
56)     <li>Verify that your clock and timezone are set
57)     correctly. If possible, synchronize your clock with public <a
58)     href="http://en.wikipedia.org/wiki/Network_Time_Protocol">time
59)     servers</a>.
60)     </li>

61) 

62)     <li><strong>Manual Configuration</strong>:

63)     <ul>

64)     <li>Edit the bottom part of <a href="<page docs/faq>#torrc">your
65)     torrc file</a>. If you want to be a public relay (recommended),
66)     make sure to define ORPort and <a href="<page
67)     docs/faq>#ExitPolicies">look at ExitPolicy</a>; otherwise

68)     if you want to be a <a href="<page docs/faq>#RelayOrBridge">bridge</a>

69)     for users in countries that censor their Internet,
70)     just use <a href="<page docs/bridges>#RunningABridge">these lines</a>.
71)     </li>

72)     </ul></li>

73) 

74)     <li><strong>Configuring Tor with the Vidalia Graphical Interface</strong>:
75)     <ol>

76) 

77)     <li>
78)     	<dt>Right click on the Vidalia icon in your task bar.  Choose <tt>Control Panel</tt>.</dt>

79)     	<dd><img alt="vidalia right click menu" src="$(IMGROOT)/screenshot-win32-vidalia.png" /></dd>

80)     </li>

81) 

82)     <li>Click <tt>Setup Relaying</tt>.</li>

83) 

84)     <li>

85)     	<dt>Choose <tt>Relay Traffic for the Tor network</tt> if you

86) want to be a public relay (recommended), or choose <tt>Help

87) censored users reach the Tor network</tt> if you want to be a <a

88) href="<page docs/faq>#RelayOrBridge">bridge</a> for users in countries
89) that censor their Internet.</dt>

90)     <dd><img alt="vidalia basic settings" src="$(IMGROOT)/screenshot-win32-configure-relay-1.png" /></dd>

91)     </li>

92) 

93)     <li>Enter a nickname for your relay, and enter contact information in
94)     case we need to contact you about problems.</li>

95) 

96)     <li>Leave <tt>Attempt to automatically configure port forwarding</tt> clicked.
97)     Push the <tt>Test</tt> button to see if it works.  If it does work, great.
98)     If not, see number 3 below.</li>

99) 

100)     <li><dt>Choose the <tt>Bandwidth Limits</tt> tab.  Select how much bandwidth you want to provide for Tor users like yourself.</dt>

101)     <dd><img alt="vidalia bandwidth limits" src="$(IMGROOT)/screenshot-win32-configure-relay-2.png" /></dd>

102)     </li>
103) 

104)     <li><dt>Choose the <tt>Exit Policies</tt> tab.  If you want to allow others
105)     to use your relay for these services, don't change anything.  Un-check

106)     the services you don't want to allow people to <a href="<page
107)     docs/faq>#ExitPolicies">reach from your relay</a>.  If you want to
108)     be a non-exit relay, un-check all services.</dt>

109)     <dd><img alt="vidalia exit policies" src="$(IMGROOT)/screenshot-win32-configure-relay-3.png" /></dd>

110)     </li>

111) 

112)     <li>Click the <tt>Ok</tt> button.  See Step Three below for confirmation
113)     that the relay is working correctly.</li>
114)     </ol>

115) 

116)     <li>If you are using a firewall, open a hole in your firewall
117)     so incoming connections can reach the ports you configured
118)     (ORPort, plus DirPort if you enabled it). If you have a
119)     hardware firewall (Linksys box, cablemodem, etc) you might like <a
120)     href="http://portforward.com/">portforward.com</a>. Also, make sure you
121)     allow all <em>outgoing</em> connections too, so your relay can reach the
122)     other Tor relays.
123)     </li>

124) 

125)     <li>Restart your relay. If it <a

126)     href="<page docs/faq>#Logs">logs

127)     any warnings</a>, address them.
128)     </li>

129) 

130)     <li>Subscribe to the <a

131)     href="https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-announce">tor-announce</a>

132)     mailing list. It is very low volume, and it will keep you informed
133)     of new stable releases. You might also consider subscribing to <a
134)     href="<page docs/documentation>#MailingLists">the higher-volume Tor lists</a>

135)     too.</li>
136)     <li><a href="https://weather.torproject.org/">Tor Weather</a> provides
137)     an email notification service to any users who want to monitor the
138)     status of a Tor node. Upon subscribing, you can specify what types of
139)     alerts you would like to receive. The main purpose of Tor Weather is
140)     to notify node operators via email if their node is down for longer
141)     than a specified period, but other notification types are available.

142)     </li>

143) 

144)     </li></ol>

145) 

146)     <hr>

147)     <a id="check"></a>
148)     <h2><a class="anchor" href="#check">Step Three: Make sure it is working</a></h2>

149)     <br>

150) 

151)     <p>As soon as your relay manages to connect to the network, it will
152)     try to determine whether the ports you configured are reachable from
153)     the outside. This step is usually fast, but may take up to 20

154)     minutes. Look for a <a href="<page docs/faq>#Logs">log entry</a> like

155)     <tt>Self-testing indicates your ORPort is reachable from the outside. Excellent.</tt>
156)     If you don't see this message, it means that your relay is not reachable
157)     from the outside &mdash; you should re-check your firewalls, check that it's
158)     testing the IP and port you think it should be testing, etc.
159)     </p>

160) 

161)     <p>When it decides that it's reachable, it will upload a "server
162)     descriptor" to the directories, to let clients know
163)     what address, ports, keys, etc your relay is using. You can <a
164)     href="http://194.109.206.212/tor/status-vote/current/consensus">load one of
165)     the network statuses manually</a> and
166)     look through it to find the nickname you configured, to make sure it's
167)     there. You may need to wait up to one hour to give enough time for it to
168)     make a fresh directory.</p>

169) 

170)     <hr>

171)     <a id="after"></a>
172)     <h2><a class="anchor" href="#after">Step Four: Once it is working</a></h2>

173)     <br>

174) 

175)     <p>
176)     We recommend the following steps as well:
177)     </p>

178) 

179)     <p>
180)     6. Read

181)     <a href="<wiki>doc/OperationalSecurity">about operational security</a>

182)     to get ideas how you can increase the security of your relay.
183)     </p>

184) 

185)     <p>
186)     7. If you want to run more than one relay that's great, but please set <a

187)     href="<page docs/faq>#MultipleRelays">the

188)     MyFamily option</a> in all your relays' configuration files.
189)     </p>

190) 

191)     <p>
192)     8. Decide about rate limiting. Cable modem, DSL, and other users
193)     who have asymmetric bandwidth (e.g. more down than up) should
194)     rate limit to their slower bandwidth, to avoid congestion. See the <a

195)     href="<wikifaq>#LimitBandwidth">rate

196)     limiting FAQ entry</a> for details.
197)     </p>

198) 

199)     <p>
200)     9. Back up your Tor relay's private key (stored in "keys/secret_id_key"
201)     in your DataDirectory). This is your relay's "identity," and
202)     you need to keep it safe so nobody can read the traffic that goes
203)     through your relay. This is the critical file to keep if you need to <a

204)     href="<wikifaq>#UpgradeRelay">move

205)     or restore your Tor relay</a> if something goes wrong.
206)     </p>

207) 

208)     <p>

209) 

210)     10. If you control the name servers for your domain, consider setting your
211)     reverse DNS hostname to 'anonymous-relay', 'proxy' or 'tor-proxy', so when
212)     other people see the address in their web logs, they will more quickly
213)     understand what's going on. Adding the <a
214)     href="<gitblob>contrib/tor-exit-notice.html">Tor
215)     exit notice</a> on a vhost for this name can go a long way to deterring abuse
216)     complaints to you and your ISP if you are running an exit node.

217) 

218)     </p>

219) 

220)     <p>
221)     11. If your computer isn't running a webserver, please consider
222)     changing your ORPort to 443 and your DirPort to 80. Many Tor
223)     users are stuck behind firewalls that only let them browse the
224)     web, and this change will let them reach your Tor relay. Win32
225)     relays can simply change their ORPort and DirPort directly
226)     in their torrc and restart Tor. OS X or Unix relays can't bind
227)     directly to these ports (since they don't run as root), so they will
228)     need to set up some sort of <a

229)     href="<wikifaq>#ServerForFirewalledClients">

230)     port forwarding</a> so connections can reach their Tor relay. If you are
231)     using ports 80 and 443 already but still want to help out, other useful
232)     ports are 22, 110, and 143.
233)     </p>

234) 

235)     <p>
236)     12. If your Tor relay provides other services on the same IP address
237)     &mdash; such as a public webserver &mdash; make sure that connections to the
238)     webserver are allowed from the local host too. You need to allow these
239)     connections because Tor clients will detect that your Tor relay is the <a

240)     href="<wikifaq>#ExitEavesdroppers">safest

241)     way to reach that webserver</a>, and always build a circuit that ends
242)     at your relay. If you don't want to allow the connections, you must
243)     explicitly reject them in your exit policy.
244)     </p>

245) 

246)     <p>
247)     13. (Unix only). Make a separate user to run the relay. If you
248)     installed the OS X package or the deb or the rpm, this is already
249)     done. Otherwise, you can do it by hand. (The Tor relay doesn't need to
250)     be run as root, so it's good practice to not run it as root. Running
251)     as a 'tor' user avoids issues with identd and other services that
252)     detect user name. If you're the paranoid sort, feel free to <a

253)     href="<wiki>doc/TorInChroot">put Tor

254)     into a chroot jail</a>.)
255)     </p>

256) 

257)     <p>
258)     14. (Unix only.) Your operating system probably limits the number
259)     of open file descriptors per process to 1024 (or even less). If you
260)     plan to be running a fast exit node, this is probably not enough. On
261)     Linux, you should add a line like "toruser hard nofile 8192" to your
262)     /etc/security/limits.conf file (where toruser is the user that runs the
263)     Tor process), and then restart Tor if it's installed as a package (or log

264)     out and log back in if you run it yourself). The Debian/Ubuntu package
265)     does this step for you.

266)     </p>

267) 

268)     <p>
269)     15. If you installed Tor via some package or installer, it probably starts
270)     Tor for you automatically on boot. But if you installed from source,
271)     you may find the initscripts in contrib/tor.sh or contrib/torctl useful.
272)     </p>

273) 

274)     <p>
275)     When you change your Tor configuration, remember to verify that your
276)     relay still works correctly after the change. Be sure to set your
277)     "ContactInfo" line in the torrc so we can contact you if you need to
278)     upgrade or something goes wrong. If you have problems or questions, see
279)     the <a href="<page docs/documentation>#Support">Support</a> section or
280)     <a href="<page about/contact>">contact us</a> on the tor-ops list. Thanks
281)     for helping to make the Tor network grow!
282)     </p>

283) 

284)     <hr>

285) 

286)     <p>If you have suggestions for improving this document, please <a
287)     href="<page about/contact>">send them to us</a>. Thanks!</p>
288)   </div>
289)   <!-- END MAINCOL -->
290)   <div id = "sidecol">
291) #include "side.wmi"
292) #include "info.wmi"
293)   </div>
294)   <!-- END SIDECOL -->
295) </div>
296) <!-- END CONTENT -->