tor-webwml.git

docs/en/tor-doc-server.wml   1) ## translation metadata
docs/en/tor-doc-server.wml   2) # Revision: $Revision$
docs/en/tor-doc-server.wml   3) 

docs/en/tor-doc-relay.wml    4) #include "head.wmi" TITLE="Relay Configuration Instructions"

docs/en/tor-doc-server.wml   5) 
docs/en/tor-doc-server.wml   6) <div class="center">
docs/en/tor-doc-server.wml   7) 
docs/en/tor-doc-server.wml   8) <div class="main-column">
docs/en/tor-doc-server.wml   9) 

docs/en/tor-doc-relay.wml   10) <h1>Configuring a <a href="<page index>">Tor</a> relay</h1>

docs/en/tor-doc-server.wml  11) <br />
docs/en/tor-doc-server.wml  12) 
docs/en/tor-doc-server.wml  13) <p>
docs/en/tor-doc-server.wml  14) The Tor network relies on volunteers to donate bandwidth. The more

docs/en/tor-doc-relay.wml   15) people who run relays, the faster the Tor network will be. If you have

docs/en/tor-doc-server.wml  16) at least 20 kilobytes/s each way, please help out Tor by configuring your

docs/en/tor-doc-relay.wml   17) Tor to be a relay too. We have many features that make Tor relays easy

docs/en/tor-doc-server.wml  18) and convenient, including rate limiting for bandwidth, exit policies so
docs/en/tor-doc-server.wml  19) you can limit your exposure to abuse complaints, and support for dynamic
docs/en/tor-doc-server.wml  20) IP addresses.</p>
docs/en/tor-doc-server.wml  21) 

docs/en/tor-doc-relay.wml   22) <p>Having relays in many different places on the Internet is what

docs/en/tor-doc-server.wml  23) makes Tor users secure. <a
docs/en/tor-doc-server.wml  24) href="http://wiki.noreply.org/noreply/TheOnionRouter/TorFAQ#ServerAnonymity">You
docs/en/tor-doc-server.wml  25) may also get stronger anonymity yourself</a>,
docs/en/tor-doc-server.wml  26) since remote sites can't know whether connections originated at your
docs/en/tor-doc-server.wml  27) computer or were relayed from others.</p>
docs/en/tor-doc-server.wml  28) 

docs/en/tor-doc-relay.wml   29) <p>Setting up a Tor relay is easy and convenient:

docs/en/tor-doc-server.wml  30) <ul>
docs/en/tor-doc-server.wml  31) <li>Tor has built-in support for <a
docs/en/tor-doc-server.wml  32) href="http://wiki.noreply.org/noreply/TheOnionRouter/TorFAQ#LimitBandwidth">rate
docs/en/tor-doc-server.wml  33) limiting</a>. Further, if you have a fast link
docs/en/tor-doc-server.wml  34) but want to limit the number of bytes per day
docs/en/tor-doc-server.wml  35) (or week or month) that you donate, check out the <a
docs/en/tor-doc-server.wml  36) href="http://wiki.noreply.org/noreply/TheOnionRouter/TorFAQ#Hibernation">hibernation
docs/en/tor-doc-server.wml  37) feature</a>.
docs/en/tor-doc-server.wml  38) </li>

docs/en/tor-doc-relay.wml   39) <li>Each Tor relay has an <a

docs/en/tor-doc-server.wml  40) href="http://wiki.noreply.org/noreply/TheOnionRouter/TorFAQ#RunAServerBut">exit
docs/en/tor-doc-server.wml  41) policy</a> that specifies what sort of outbound connections are allowed

docs/en/tor-doc-relay.wml   42) or refused from that relay. If you are uncomfortable allowing people
docs/en/tor-doc-relay.wml   43) to exit from your relay, you can set it up to only allow connections
docs/en/tor-doc-relay.wml   44) to other Tor relays.

docs/en/tor-doc-server.wml  45) </li>

docs/en/tor-doc-relay.wml   46) <li>It's fine if the relay goes offline sometimes. The directories
docs/en/tor-doc-relay.wml   47) notice this quickly and stop advertising the relay. Just try to make
docs/en/tor-doc-relay.wml   48) sure it's not too often, since connections using the relay when it

docs/en/tor-doc-server.wml  49) disconnects will break.
docs/en/tor-doc-server.wml  50) </li>

docs/en/tor-doc-relay.wml   51) <li>We can handle relays with dynamic IPs just fine &mdash; simply

docs/en/tor-doc-server.wml  52) leave the Address config option blank, and Tor will try to guess.

docs/en/tor-doc-server.wml  53) </li>

docs/en/tor-doc-relay.wml   54) <li>If your relay is behind a NAT and it doesn't know its public

docs/en/tor-doc-server.wml  55) IP (e.g. it has an IP of 192.168.x.y), you'll need to set up port
docs/en/tor-doc-server.wml  56) forwarding. Forwarding TCP connections is system dependent but <a

docs/en/tor-doc-server.wml  57) href="http://wiki.noreply.org/noreply/TheOnionRouter/TorFAQ#ServerForFirewalledClients">this
docs/en/tor-doc-server.wml  58) FAQ entry</a> offers some examples on how to do this.

docs/en/tor-doc-server.wml  59) </li>

docs/en/tor-doc-relay.wml   60) <li>Your relay will passively estimate and advertise its recent
docs/en/tor-doc-relay.wml   61) bandwidth capacity, so high-bandwidth relays will attract more users than
docs/en/tor-doc-relay.wml   62) low-bandwidth ones. Therefore having low-bandwidth relays is useful too.

docs/en/tor-doc-server.wml  63) </li>
docs/en/tor-doc-server.wml  64) </ul>
docs/en/tor-doc-server.wml  65) 

docs/en/tor-doc-relay.wml   66) <p>You can run a Tor relay on

docs/en/tor-doc-server.wml  67) pretty much any operating system, but see <a
docs/en/tor-doc-server.wml  68) href="http://wiki.noreply.org/noreply/TheOnionRouter/TorFAQ#ServerOS">this
docs/en/tor-doc-server.wml  69) FAQ entry</a> for advice about which ones work best and other problems
docs/en/tor-doc-server.wml  70) you might encounter.</p>
docs/en/tor-doc-server.wml  71) 
docs/en/tor-doc-server.wml  72) <hr />
docs/en/tor-doc-server.wml  73) <a id="zero"></a>
docs/en/tor-doc-server.wml  74) <h2><a class="anchor" href="#zero">Step Zero: Download and Install Tor</a></h2>
docs/en/tor-doc-server.wml  75) <br />
docs/en/tor-doc-server.wml  76) 
docs/en/tor-doc-server.wml  77) <p>Before you start, you need to make sure that Tor is up and running.
docs/en/tor-doc-server.wml  78) </p>
docs/en/tor-doc-server.wml  79) 
docs/en/tor-doc-server.wml  80) <p>For Windows users, this means at least <a

docs/en/tor-doc-server.wml  81) href="<page docs/tor-doc-win32>#installing">step one</a>

docs/en/tor-doc-server.wml  82) of the Windows Tor installation howto. Mac OS X users need to do at least

docs/en/tor-doc-server.wml  83) <a href="<page docs/tor-doc-osx>#installing">step one</a>

docs/en/tor-doc-server.wml  84) of OS X Tor installation howto.  Linux/BSD/Unix users should do at least

docs/en/tor-doc-server.wml  85) <a href="<page docs/tor-doc-unix>#installing">step one</a>

docs/en/tor-doc-server.wml  86) of the Unix Tor installation howto.
docs/en/tor-doc-server.wml  87) </p>
docs/en/tor-doc-server.wml  88) 
docs/en/tor-doc-server.wml  89) <p>If it's convenient, you might also want to use it as a client for a
docs/en/tor-doc-server.wml  90) while to make sure it's actually working.</p>
docs/en/tor-doc-server.wml  91) 
docs/en/tor-doc-server.wml  92) <hr />

docs/en/tor-doc-server.wml  93) <a id="setup"></a>

docs/en/tor-doc-relay.wml   94) <h2><a class="anchor" href="#setup">Step One: Set it up as a relay</a></h2>

docs/en/tor-doc-server.wml  95) <br />
docs/en/tor-doc-server.wml  96) 
docs/en/tor-doc-server.wml  97) <p>
docs/en/tor-doc-server.wml  98) 1. Verify that your clock is set correctly. If possible, synchronize

docs/en/tor-doc-server.wml  99) your clock with public time servers.

docs/en/tor-doc-server.wml 100) </p>
docs/en/tor-doc-server.wml 101) 
docs/en/tor-doc-server.wml 102) <p>

docs/en/tor-doc-server.wml 103) 2. Make sure name resolution works (that is, your computer can resolve
docs/en/tor-doc-server.wml 104) Internet addresses correctly).

docs/en/tor-doc-server.wml 105) </p>
docs/en/tor-doc-server.wml 106) 
docs/en/tor-doc-server.wml 107) <p>
docs/en/tor-doc-server.wml 108) 3. Edit the bottom part of your torrc. (See <a
docs/en/tor-doc-server.wml 109) href="http://wiki.noreply.org/wiki/TheOnionRouter/TorFAQ#torrc">this
docs/en/tor-doc-server.wml 110) FAQ entry</a> for help.)
docs/en/tor-doc-server.wml 111) Make sure to define at least Nickname and ORPort. Create the DataDirectory
docs/en/tor-doc-server.wml 112) if necessary, and make sure it's owned by the user that will be running

docs/en/tor-doc-relay.wml  113) tor. <em>If you want to run more than one relay that's great, but

docs/en/tor-doc-server.wml 114) please set <a href="http://wiki.noreply.org/noreply/TheOnionRouter/TorFAQ#MultipleServers">the

docs/en/tor-doc-relay.wml  115) MyFamily option</a> in all your relays' configuration files.</em>

docs/en/tor-doc-server.wml 116) </p>
docs/en/tor-doc-server.wml 117) 
docs/en/tor-doc-server.wml 118) <p>
docs/en/tor-doc-server.wml 119) 4. If you are using a firewall, open a hole in your firewall so

docs/en/tor-doc-relay.wml  120) incoming connections can reach the ports you configured (ORPort, plus

docs/en/tor-doc-server.wml 121) DirPort if you enabled it). Make sure you allow all outgoing connections,

docs/en/tor-doc-relay.wml  122) so your relay can reach the other Tor relays.

docs/en/tor-doc-server.wml 123) </p>
docs/en/tor-doc-server.wml 124) 
docs/en/tor-doc-server.wml 125) <p>

docs/en/tor-doc-relay.wml  126) 5. Restart your relay. If it <a

docs/en/tor-doc-server.wml 127) href="http://wiki.noreply.org/noreply/TheOnionRouter/TorFAQ#Logs">logs
docs/en/tor-doc-server.wml 128) any warnings</a>, address them.

docs/en/tor-doc-server.wml 129) </p>
docs/en/tor-doc-server.wml 130) 
docs/en/tor-doc-server.wml 131) <p>
docs/en/tor-doc-server.wml 132) 6. Subscribe to the <a
docs/en/tor-doc-server.wml 133) href="http://archives.seul.org/or/announce/">or-announce</a>
docs/en/tor-doc-server.wml 134) mailing list. It is very low volume, and it will keep you informed
docs/en/tor-doc-server.wml 135) of new stable releases. You might also consider subscribing to <a
docs/en/tor-doc-server.wml 136) href="http://archives.seul.org/or/talk/">or-talk</a> (higher volume),
docs/en/tor-doc-server.wml 137) where new development releases are announced.
docs/en/tor-doc-server.wml 138) </p>
docs/en/tor-doc-server.wml 139) 
docs/en/tor-doc-server.wml 140) <p>
docs/en/tor-doc-server.wml 141) 7. Have a look at the manual.
docs/en/tor-doc-server.wml 142) The <a href="<page tor-manual>">manual</a> for the

docs/en/tor-doc-server.wml 143) latest stable version provides a list of all the possible configuration

docs/en/tor-doc-relay.wml  144) options for both clients and relays.

docs/en/tor-doc-server.wml 145) If you are running the development version of Tor, the manual is available

docs/en/tor-doc-server.wml 146) <a href="<page tor-manual-dev>">here</a>.

docs/en/tor-doc-server.wml 147) </p>
docs/en/tor-doc-server.wml 148) 
docs/en/tor-doc-server.wml 149) <hr />

docs/en/tor-doc-server.wml 150) <a id="check"></a>
docs/en/tor-doc-server.wml 151) <h2><a class="anchor" href="#check">Step Two: Make sure it's working</a></h2>

docs/en/tor-doc-server.wml 152) <br />
docs/en/tor-doc-server.wml 153) 

docs/en/tor-doc-relay.wml  154) <p>As soon as your relay manages to connect to the network, it will

docs/en/tor-doc-server.wml 155) try to determine whether the ports you configured are reachable from

docs/en/tor-doc-server.wml 156) the outside. This may take up to 20 minutes. Look for a
docs/en/tor-doc-server.wml 157) <a href="http://wiki.noreply.org/noreply/TheOnionRouter/TorFAQ#Logs">log
docs/en/tor-doc-server.wml 158) entry</a> like

docs/en/tor-doc-server.wml 159) <tt>Self-testing indicates your ORPort is reachable from the outside. Excellent.</tt>

docs/en/tor-doc-relay.wml  160) If you don't see this message, it means that your relay is not reachable

docs/en/tor-doc-server.wml 161) from the outside — you should re-check your firewalls, check that it's
docs/en/tor-doc-server.wml 162) testing the IP and port you think it should be testing, etc.
docs/en/tor-doc-server.wml 163) </p>
docs/en/tor-doc-server.wml 164) 
docs/en/tor-doc-server.wml 165) <p>When it decides that it's reachable, it will upload a "server
docs/en/tor-doc-server.wml 166) descriptor" to the directories. This will let clients know

docs/en/tor-doc-relay.wml  167) what address, ports, keys, etc your relay is using. You can <a

docs/en/tor-doc-server.wml 168) href="http://moria.seul.org:9032/tor/status/authority">load one of
docs/en/tor-doc-server.wml 169) the network statuses manually</a> and

docs/en/tor-doc-server.wml 170) look through it to find the nickname you configured, to make sure it's
docs/en/tor-doc-server.wml 171) there. You may need to wait a few seconds to give enough time for it to
docs/en/tor-doc-server.wml 172) make a fresh directory.</p>
docs/en/tor-doc-server.wml 173) 
docs/en/tor-doc-server.wml 174) <hr />

docs/en/tor-doc-server.wml 175) <a id="after"></a>
docs/en/tor-doc-server.wml 176) <h2><a class="anchor" href="#after">Step Three: Once it's working</a></h2>

docs/en/tor-doc-server.wml 177) <br />
docs/en/tor-doc-server.wml 178) 
docs/en/tor-doc-server.wml 179) <p>

docs/en/tor-doc-server.wml 180) We recommend the following steps as well:

docs/en/tor-doc-server.wml 181) </p>
docs/en/tor-doc-server.wml 182) 
docs/en/tor-doc-server.wml 183) <p>

docs/en/tor-doc-server.wml 184) 8. Read
docs/en/tor-doc-server.wml 185) <a href="http://wiki.noreply.org/noreply/TheOnionRouter/OperationalSecurity">this document</a>

docs/en/tor-doc-relay.wml  186) to get ideas how you can increase the security of your relay.

docs/en/tor-doc-server.wml 187) </p>
docs/en/tor-doc-server.wml 188) 
docs/en/tor-doc-server.wml 189) <p>

docs/en/tor-doc-relay.wml  190) 9. Decide what exit policy you want. By default your relay allows

docs/en/tor-doc-server.wml 191) access to many popular services, but restricts some (such as port 25)

docs/en/tor-doc-server.wml 192) due to abuse potential. You might want an exit policy that is
docs/en/tor-doc-server.wml 193) less restrictive or more restrictive; edit your torrc appropriately.
docs/en/tor-doc-server.wml 194) Read the FAQ entry on <a
docs/en/tor-doc-server.wml 195) href="<page faq-abuse>#TypicalAbuses">issues you might
docs/en/tor-doc-server.wml 196) encounter if you use the default exit policy</a>.
docs/en/tor-doc-server.wml 197) If you choose a particularly open exit policy, you should make
docs/en/tor-doc-server.wml 198) sure your ISP is ok with that choice.

docs/en/tor-doc-server.wml 199) If there are any resources that your computer can't reach (for example,
docs/en/tor-doc-server.wml 200) you are behind a restrictive firewall or content filter), please
docs/en/tor-doc-server.wml 201) explicitly reject them in your exit policy — otherwise Tor users
docs/en/tor-doc-server.wml 202) will be impacted too.

docs/en/tor-doc-server.wml 203) </p>
docs/en/tor-doc-server.wml 204) 
docs/en/tor-doc-server.wml 205) <p>

docs/en/tor-doc-server.wml 206) 10. Decide about rate limiting. Cable modem, DSL, and other users

docs/en/tor-doc-server.wml 207) who have asymmetric bandwidth (e.g. more down than up) should
docs/en/tor-doc-server.wml 208) rate limit to their slower bandwidth, to avoid congestion. See the <a
docs/en/tor-doc-server.wml 209) href="http://wiki.noreply.org/noreply/TheOnionRouter/TorFAQ#LimitBandwidth">rate
docs/en/tor-doc-server.wml 210) limiting FAQ entry</a> for details.
docs/en/tor-doc-server.wml 211) </p>
docs/en/tor-doc-server.wml 212) 
docs/en/tor-doc-server.wml 213) <p>

docs/en/tor-doc-relay.wml  214) 11. Back up your Tor relay's private key (stored in "keys/secret_id_key"
docs/en/tor-doc-relay.wml  215) in your DataDirectory). This is your relay's "identity," and

docs/en/tor-doc-server.wml 216) you need to keep it safe so nobody can read the traffic that goes

docs/en/tor-doc-relay.wml  217) through your relay. This is the critical file to keep if you need to <a

docs/en/tor-doc-server.wml 218) href="http://wiki.noreply.org/noreply/TheOnionRouter/TorFAQ#UpgradeServer">move

docs/en/tor-doc-relay.wml  219) or restore your Tor relay</a> if something goes wrong.

docs/en/tor-doc-server.wml 220) </p>
docs/en/tor-doc-server.wml 221) 
docs/en/tor-doc-server.wml 222) <p>

docs/en/tor-doc-server.wml 223) 12. If you control the name servers for your domain, consider setting

docs/en/tor-doc-server.wml 224) your hostname to 'anonymous' or 'proxy' or 'tor-proxy', so when other
docs/en/tor-doc-server.wml 225) people see the address in their web logs, they will more quickly
docs/en/tor-doc-server.wml 226) understand what's going on.
docs/en/tor-doc-server.wml 227) </p>
docs/en/tor-doc-server.wml 228) 
docs/en/tor-doc-server.wml 229) <p>

docs/en/tor-doc-server.wml 230) 13. If your computer isn't running a webserver, please consider

docs/en/tor-doc-server.wml 231) changing your ORPort to 443 and your DirPort to 80. Many Tor
docs/en/tor-doc-server.wml 232) users are stuck behind firewalls that only let them browse the

docs/en/tor-doc-relay.wml  233) web, and this change will let them reach your Tor relay. Win32
docs/en/tor-doc-relay.wml  234) relays can simply change their ORPort and DirPort directly
docs/en/tor-doc-relay.wml  235) in their torrc and restart Tor. OS X or Unix relays can't bind

docs/en/tor-doc-server.wml 236) directly to these ports (since they don't run as root), so they will
docs/en/tor-doc-server.wml 237) need to set up some sort of <a
docs/en/tor-doc-server.wml 238) href="http://wiki.noreply.org/wiki/TheOnionRouter/TorFAQ#ServerForFirewalledClients">

docs/en/tor-doc-relay.wml  239) port forwarding</a> so connections can reach their Tor relay. If you are

docs/en/tor-doc-server.wml 240) using ports 80 and 443 already but still want to help out, other useful
docs/en/tor-doc-server.wml 241) ports are 22, 110, and 143.
docs/en/tor-doc-server.wml 242) </p>
docs/en/tor-doc-server.wml 243) 
docs/en/tor-doc-server.wml 244) <p>

docs/en/tor-doc-relay.wml  245) 14. If your Tor relay provides other services on the same IP address

docs/en/tor-doc-server.wml 246) — such as a public webserver — make sure that connections to the
docs/en/tor-doc-server.wml 247) webserver are allowed from the local host too. You need to allow these

docs/en/tor-doc-relay.wml  248) connections because Tor clients will detect that your Tor relay is the <a

docs/en/tor-doc-server.wml 249) href="http://wiki.noreply.org/noreply/TheOnionRouter/TorFAQ#ExitEavesdroppers">safest
docs/en/tor-doc-server.wml 250) way to reach that webserver</a>, and always build a circuit that ends

docs/en/tor-doc-relay.wml  251) at your relay. If you don't want to allow the connections, you must

docs/en/tor-doc-server.wml 252) explicitly reject them in your exit policy.
docs/en/tor-doc-server.wml 253) </p>
docs/en/tor-doc-server.wml 254) 
docs/en/tor-doc-server.wml 255) <p>

docs/en/tor-doc-relay.wml  256) 15. (Unix only). Make a separate user to run the relay. If you

docs/en/tor-doc-server.wml 257) installed the OS X package or the deb or the rpm, this is already

docs/en/tor-doc-relay.wml  258) done. Otherwise, you can do it by hand. (The Tor relay doesn't need to

docs/en/tor-doc-server.wml 259) be run as root, so it's good practice to not run it as root. Running
docs/en/tor-doc-server.wml 260) as a 'tor' user avoids issues with identd and other services that
docs/en/tor-doc-server.wml 261) detect user name. If you're the paranoid sort, feel free to <a
docs/en/tor-doc-server.wml 262) href="http://wiki.noreply.org/wiki/TheOnionRouter/TorInChroot">put Tor
docs/en/tor-doc-server.wml 263) into a chroot jail</a>.)
docs/en/tor-doc-server.wml 264) </p>
docs/en/tor-doc-server.wml 265) 
docs/en/tor-doc-server.wml 266) <p>

docs/en/tor-doc-server.wml 267) 16. (Unix only.) Your operating system probably limits the number

docs/en/tor-doc-server.wml 268) of open file descriptors per process to 1024 (or even less). If you
docs/en/tor-doc-server.wml 269) plan to be running a fast exit node, this is probably not enough. On
docs/en/tor-doc-server.wml 270) Linux, you should add a line like "toruser hard nofile 8192" to your
docs/en/tor-doc-server.wml 271) /etc/security/limits.conf file (where toruser is the user that runs the
docs/en/tor-doc-server.wml 272) Tor process), and then restart Tor if it's installed as a package (or log
docs/en/tor-doc-server.wml 273) out and log back in if you run it yourself). If that doesn't work, see <a
docs/en/tor-doc-server.wml 274) href="http://wiki.noreply.org/noreply/TheOnionRouter/TorFAQ#FileDescriptors">this
docs/en/tor-doc-server.wml 275) FAQ entry</a> for other suggested ways to run "ulimit -n 8192" before
docs/en/tor-doc-server.wml 276) you launch Tor.
docs/en/tor-doc-server.wml 277) </p>
docs/en/tor-doc-server.wml 278) 
docs/en/tor-doc-server.wml 279) <p>

docs/en/tor-doc-server.wml 280) 17. If you installed Tor via some package or installer, it probably starts

docs/en/tor-doc-server.wml 281) Tor for you automatically on boot. But if you installed from source,
docs/en/tor-doc-server.wml 282) you may find the initscripts in contrib/tor.sh or contrib/torctl useful.
docs/en/tor-doc-server.wml 283) </p>
docs/en/tor-doc-server.wml 284) 

docs/en/tor-doc-server.wml 285) <p>

docs/en/tor-doc-server.wml 286) When you change your Tor configuration, remember to verify that your

docs/en/tor-doc-relay.wml  287) relay still works correctly after the change. Be sure to set your

docs/en/tor-doc-server.wml 288) "ContactInfo" line in the torrc so we can contact you if you need to
docs/en/tor-doc-server.wml 289) upgrade or something goes wrong. If you have problems or questions, see
docs/en/tor-doc-server.wml 290) the <a href="<page documentation>#Support">Support</a> section or
docs/en/tor-doc-server.wml 291) <a href="<page contact>">contact us</a> on the tor-ops list. Thanks
docs/en/tor-doc-server.wml 292) for helping to make the Tor network grow!

docs/en/tor-doc-server.wml 293) </p>
docs/en/tor-doc-server.wml 294) 

docs/en/tor-doc-server.wml 295) <hr />
docs/en/tor-doc-server.wml 296) 

docs/en/tor-doc-server.wml 297) <p>If you have suggestions for improving this document, please <a
docs/en/tor-doc-server.wml 298) href="<page contact>">send them to us</a>. Thanks!</p>