How to Run Tor Relay for VPS Without Wasting Data

Wetin Tor relay dey do for VPS

Tor relay na Tor daemon wey dey run for machine wey get public IP address, and e dey forward encrypted traffic for other people. Directory authorities dey publish am, and Tor clients dey build circuits through am. Guard or middle relay only dey pass traffic go another relay, so e no dey ever open connection to website on behalf of stranger. Na this fact make e no attract abuse mail, and na why e fit be the contribution wey ordinary VPS fit handle.

The work small: one package, fifteen lines of config, one firewall rule, and one restart. The remaining part of this guide na where things dey usually go wrong. E cover bandwidth calculation for metered plan, and why new relay wey dey work well fit look like say e dead for one week.

Guard, middle, bridge abi exit: choose one before you install am

One daemon fit run all four roles. Na config wey you use, plus directory authorities, go decide which one you be.

• Middle relay. E dey receive traffic from guard and pass am to another relay. E no dey contact destination site. Every new relay dey start for here.
• Guard relay. Na the same configuration, with one flag added on top. Directory authorities go give relay the Guard flag after e don fast and stable for long enough. You no fit choose am. You go earn am, and na the config below dey help you earn am.
• Bridge. Na relay wey dem deliberately keep outside public directory and share privately with users for places where Tor dey blocked. Na the smallest commitment among the four: low bandwidth, no public listing, and the correct first step if your plan small.
• Exit relay. Na the last hop, wey dey open connection go destination site. Every request wey user make go leave from your IP address, so abuse reports and police inquiries go reach whoever own that address.

Exit na the only role wey no suppose dey on general-purpose VPS. Run exit only with provider wey don agree beforehand to receive that mail, with its own IP address and published abuse contact. Most standard hosting terms forbid am, and the usual result if you ignore that na suspended server and lost IP address. Guard or middle relay still carry the same user traffic without all that exposure.

Everything below dey build guard/middle relay. ExitRelay 0 na the line wey keep am that way.

Wetin the VPS need before you start

The Tor Project publish strict requirements for relays. As of August 2026, dem be: one public IPv4 address for the relay, at least 10 Mbit/s bandwidth for each direction, with 16 Mbit/s recommended, at least 100 GB outbound traffic every month, and 512 MB RAM below 40 Mbit/s or 1 GB above am. No fixed uptime rule dey, but relay wey run less than two hours every day no dey much useful to the network.

The 10 Mbit/s figure describe the line, no be the setting. You need port wey fit handle am. How much of that line you allow the relay use na separate decision, based on the monthly transfer allowance. Read your plan before you touch the config. If you still dey choose a box, wetin VPS really cost every month explain how dem dey sell transfer allowances, and how to measure the real network throughput of a VPS show how to find out wetin the line dey do with iperf3 instead of trusting the sales page.

Harden the machine first. Relay na public service for public address, and dem go scan the address within minutes after you publish am. How to lock SSH down to keys and hardened sshd config take ten minutes, and e suppose happen before the relay go live, no be after.

Tor Project repository wey you fit use install tor

Make you use Tor Project own apt repository instead of the distribution package. Relay code dey change faster than stable release, so fixes dey reach this repository first, while distribution package dey lag between releases.

sudo apt update
sudo apt install -y apt-transport-https gnupg wget

Add the signing key first, then add the repository. The machine go read the codename by itself, so this same block go work for Ubuntu 24.04 (noble) and Debian 13 (trixie).

wget -qO- https://deb.torproject.org/torproject.org/A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc \
  | gpg --dearmor \
  | sudo tee /usr/share/keyrings/deb.torproject.org-keyring.gpg >/dev/null

CODENAME=$(. /etc/os-release && echo "$VERSION_CODENAME")
echo "$CODENAME"

sudo tee /etc/apt/sources.list.d/tor.sources >/dev/null <<EOF
Types: deb deb-src
URIs: https://deb.torproject.org/torproject.org/
Suites: $CODENAME
Components: main
Signed-By: /usr/share/keyrings/deb.torproject.org-keyring.gpg
EOF

sudo apt update
sudo apt install -y tor deb.torproject.org-keyring
tor --version

tor --version dey print the version wey you just install. If apt update print NO_PUBKEY error instead, the dearmored key no dey for the path wey Signed-By: line name, so apt no get key to use check the release file. The deb.torproject.org-keyring package important later: e ship the signing key as ordinary package, so apt go continue work when dem rotate the key.

Turn on automatic upgrades, then configure dem to include the new origin.

sudo apt install -y unattended-upgrades apt-listchanges

For Ubuntu, add the Tor origin to the Allowed-Origins block inside /etc/apt/apt.conf.d/50unattended-upgrades:

Unattended-Upgrade::Allowed-Origins {
        "${distro_id}:${distro_codename}-security";
        "TorProject:${distro_codename}";
};

For Debian, the same file dey use Origins-Pattern, and the line wey you need add na "origin=TorProject";. Check the result with sudo unattended-upgrade --debug --dry-run. E go print the origins wey e go act on, and e no go write anything.

The torrc wey matter

The package go install one long, heavily commented /etc/tor/torrc. Na only few lines matter for relay. Add dem for the end of the file.

Nickname mynicerelay
ContactInfo relay-ops[at]example.com
ORPort 9001
ExitRelay 0
SocksPort 0

Nickname na 1 to 19 characters, and na letters and digits only. E no unique across the network, and e no be your identity; na the fingerprint be your identity. Na how you go find your own relay for search box, so pick something wey you fit spell for phone.

ContactInfo dey published inside relay descriptor. Relay descriptor na public document wey anybody fit download, so people go scrape the address. Use address wey you go still dey read after two years, and obfuscate am if you like. Na this only channel Tor Project get to warn you about problem with your relay.

ORPort 9001 na the port wey other relays and clients go connect to. 9001 na the conventional choice. Port 443 na another common choice because some restrictive networks allow only outbound 443. So relay wey dey listen there fit reachable to more clients. Pick 443 only if nothing else for the box need am.

SocksPort 0 dey switch off the local SOCKS proxy, wey relay no dey use, and e remove one listening socket from the machine. ExitRelay 0 dey write the intention inside the file: this relay no go ever connect to destination on behalf of user, and anybody wey read the config later no need work am out from the default.

If the VPS get IPv6 address, add another ORPort line. Tor no fit bind to "any" IPv6 address the way e dey do for IPv4, so write the address inside square brackets.

ORPort 9001
ORPort [2001:db8::1]:9001

For 1 GB VPS, add MaxMemInQueues 512 MB. Tor dey decide queue limit from the memory wey e see for the machine. For small shared box, this fit pass wetin you want am to use. If you set the limit yourself, tor go discard queued cells when pressure dey. The relay go survive instead of queue growing until kernel kill the process.

Open the ORPort for firewall

For inbound traffic, ORPort must dey reachable from anywhere for internet. For outbound traffic, make the relay unrestricted. E dey open connections to thousands of other relays through many different ports, and outbound allowlist fit quietly cripple am.

sudo ufw allow 9001/tcp comment 'tor ORPort'
sudo ufw status verbose

Then check the provider own network firewall. Plenty control panels dey run packet filter in front of the virtual machine. Rule wey you add with ufw no get effect there. Because of this, the port fit dey show as open for the machine but closed from outside. If ufw still new to you, the ufw rules wey suppose dey for every VPS explain the default policy and the order wey dem dey use match rules.

Sete bandwidth according to your plan

The manual describe RelayBandwidthRate as separate token bucket wey dey limit “the average incoming bandwidth usage for relayed traffic on this node to the specified number of bytes per second, and the average outgoing bandwidth usage to that same value”. Read am twice. The limit apply separately to each direction. Relay wey dey set to 1 Mbit/s fit move 1 Mbit/s enter and 1 Mbit/s comot at the same time, and provider wey dey measure both directions go bill the total.

[
  {
    "label": "1 Mbit/s",
    "torrc_rate": "125 KBytes",
    "gb_per_day": 21.6,
    "gb_per_month": "648"
  },
  {
    "label": "2 Mbit/s",
    "torrc_rate": "250 KBytes",
    "gb_per_day": 43.2,
    "gb_per_month": "1,296"
  },
  {
    "label": "5 Mbit/s",
    "torrc_rate": "625 KBytes",
    "gb_per_day": 108,
    "gb_per_month": "3,240"
  },
  {
    "label": "10 Mbit/s",
    "torrc_rate": "1250 KBytes",
    "gb_per_day": 216,
    "gb_per_month": "6,480"
  },
  {
    "label": "20 Mbit/s",
    "torrc_rate": "2500 KBytes",
    "gb_per_day": 432,
    "gb_per_month": "12,960"
  }
]

Those 5 rows na arithmetic, no be measurement: dem show wetin rate go cost if relay maintain am for full 30 days for both directions. Real relay dey below e cap most times, especially for the first weeks. Use the table to remove settings wey no fit enter your budget, no be to predict invoice down to gigabyte.

For 1 Mbit/s each way, relay dey move about 21.6 GB every day, so 30 day month go cost roughly 648 GB of metered traffic. That one fit inside 1 TB allowance, with space remain for updates and backups. If you increase am to 2 Mbit/s, the month go cost 1,296 GB, wey don already pass 1 TB plan. The last row, 20 Mbit/s, need 12,960 GB every month and e suppose dey for unmetered port. If your provider dey bill outbound traffic only, divide every figure by two. Find out which type you get before you set the rate, because the two answers differ by factor of two.

Now the config. Set rate limit first, quota second.

RelayBandwidthRate 125 KBytes
RelayBandwidthBurst 250 KBytes
AccountingMax 400 GBytes
AccountingRule sum
AccountingStart month 1 00:00

RelayBandwidthBurst na the size of token bucket, so e allow short spikes above the rate while the average still hold. About twice the rate na sensible value.

AccountingRule na the line wey many operators dey miss. The default na max, wey dey measure the larger direction against the quota. With the default, AccountingMax 400 GBytes allow 400 GB enter and 400 GB comot, wey be 800 GB for meter wey dey count both directions. AccountingRule sum count read plus write against the one quota, and na that transfer allowance dey actually measure.

Write AccountingStart too; never write AccountingMax by itself. The quota na the number, and the start line na the period wey e dey reset on. Quota wey no get period go leave relay hibernating, with nothing wey fit wake am.

Hibernation na blunt tool. When quota finish, tor go log this and stop accepting work:

Bandwidth soft limit reached; commencing hibernation. No new connections will be accepted

Relay no go wake exactly when the next period start too. Tor dey track how fast e use the last quota and choose random point inside the new interval, so thousands of relays no go return to the network for the same second. Relay wey dey disappear for the last week of every month go continue losing the stability wey directory authorities dey measure. Set RelayBandwidthRate so the cap no go ever reach, and keep AccountingMax as backstop wey go protect the invoice.

Start the relay and confirm say e reachable

sudo systemctl restart tor@default
sudo systemctl status tor@default
sudo journalctl -u tor@default -n 50

Within a few minutes, the log suppose get this line:

Self-testing indicates your ORPort is reachable from the outside. Excellent. Publishing server descriptor.

That sentence mean say other relays connect back to your ORPort and build circuit through am. Until e appear, your relay no dey inside the directory and e no dey carry any traffic. The failure go look like this:

Your server has not managed to confirm reachability for its ORPort(s) at 203.0.113.10:9001. Relays do not publish descriptors until their ORPort and DirPort are reachable. Please check your firewalls, ports, address, /etc/hosts file, etc.

Check everything one after another. ORPort open for ufw? E open too for the provider separate network firewall? The address for that message na the address wey internet really route reach you, or na private address from NAT setup? Test the port from another machine with nc -vz 203.0.113.10 9001. Tor dey repeat the self test by itself, so e go notice fixed firewall without your help. Restart go make the test happen immediately.

Your relay permanent identity na the fingerprint:

sudo cat /var/lib/tor/fingerprint

About three hours after dem publish the descriptor, the relay go show for Relay Search. Search the nickname or paste the fingerprint. That page show wetin the network know about your relay: the flags wey e get, the weight wey authorities assign to am, and the version wey e dey publish.

Why new Tor relay dey carry almost no traffic?

Because network never measure am yet, and measurement dey take weeks. Tor Project describe this ramp-up for four phases, and operator wey never read am fit conclude say relay don break and start dey change things.

For the first three days, relay no dey measured. E dey report im own self-test result, and directory authorities still cap the published weight at 20 KB, so clients almost never pick am. From about day three reach day eight, bandwidth authorities measure am properly and the weight dey rise. But dem use am only as middle hop, because no client wan make brand-new relay im first hop.

Around day eight, relay become eligible for Guard flag. Getting the flag make traffic drop, and this one dey surprise everybody. Clients skip guards when dem dey choose middle hops, because dem assume say guard already dey busy. So relay lose middle traffic before e gain guard traffic. E go refill only as clients rotate their guard sets, and this one dey take weeks. By roughly day 68, e reach steady state, where clients wey dey drop am balance clients wey dey add am.

So the honest expectation be say nothing go happen for three days, something go happen after one week, and real load go come after two months. Change one setting, then wait one week to see wetin e do. A self-hosted Uptime Kuma status page with TCP check against port 9001 na better way to use that nervous energy: e answer the question wey you fit actually control, which be whether the port still dey answer.

Monitor the relay with nyx

nyx na the terminal monitor for relay wey dey run. E dey talk to Tor control port, so first enable am for torrc:

ControlPort 9051
CookieAuthentication 1
CookieAuthFileGroupReadable 1

ControlPort dey listen only for 127.0.0.1, and cookie authentication mean say program must read secret file before e fit issue commands. Tor dey write that cookie to /run/tor/control.authcookie as user debian-tor, with mode 600, so nothing else fit read am. CookieAuthFileGroupReadable 1 dey open am to the group, and na this one let your own account run nyx without sudo.

sudo apt install -y nyx
sudo adduser "$USER" debian-tor
sudo systemctl restart tor@default

Log out and log in again, then run nyx. New group membership must apply when you log in, so if you run nyx for the same shell session, e go show permission error for the cookie file even though configuration correct. nyx dey show live bandwidth, uptime, log stream, and connection list. For the first weeks, the number wey you need monitor na the bandwidth graph, make e stay below your RelayBandwidthRate.

Relay wey pass one: MyFamily and family keys

If na one relay you get, skip this section. Two or more relays wey the same operator dey run must declare each other. This go stop clients from building circuit wey enter and comot through your machines, because one operator fit see both ends of the circuit.

The old method na to put MyFamily for every relay's torrc, and list the fingerprints of all the other relays:

MyFamily AAAAAAAAAA,BBBBBBBB

Every relay dey list every other relay. So, if you add fourth relay, you must edit four files. Tor 0.4.9 replace this method with family key. Generate one key, then share am:

tor --keygen-family myfamily

This one writes myfamily.secret_family_key and prints one FamilyId line. Copy the key file go every relay, inside the keys subdirectory of the DataDirectory (/var/lib/tor/keys for Debian and Ubuntu), and keep the .secret_family_key suffix. Add the printed FamilyId line to every torrc, then reload with sudo systemctl reload tor@default. For now, keep the MyFamily list too. Clients wey never understand family certificates yet still dey read the old list. Tor Project go announce when you fit remove am.

Wetin dey break after e don dey run

The version dey old. Unattended upgrades go replace the package, but the process wey dey run go continue use the binary wey e start with until something restart am. Compare tor --version for the machine with the version wey dey show for the relay's Relay Search page. If dem no match, network still dey see the old one, so restart the service.

The clock dey shift. Consensus documents and certificates all depend on correct time, so machine wey clock don far out go reject the consensus and stop publishing. timedatectl suppose report say system clock dey synchronized. If e no, enable systemd-timesyncd or install chrony.

The IP address change. The descriptor carry the address, and clients no fit reach address wey don move. After any provider migration or address change, restart tor and monitor for the self-test line again.

The relay slow pass wetin the plan allow. Tor's relay crypto efficient for modern processors, and the Tor Project estimate say CPU wey support AES-NI fit handle around 400 to 450 Mbit/s for each direction. Long before you reach that limit, port speed and transfer allowance go limit you. Na why the accounting section above matter pass the hardware.

FAQ

How much bandwidth Tor relay dey use?

E go use as much as you allow am, and no pass that. RelayBandwidthRate dey cap relayed traffic for each direction separately, so relay wey you set to 1 Mbit/s fit carry 1 Mbit/s come in and 1 Mbit/s go out at the same time. That one na about 21.6 GB per day, or 648 GB across 30 day month, if you count both directions. Add AccountingMax with AccountingRule sum as hard monthly quota under that rate.

Tor relay go make people send abuse complaints give me?

Guard or middle relay dey pass traffic only to other Tor relays, and e never connect to website for user. So complaints about wetin person do through Tor go meet the exit operator, no be you. Wetin you fit see na scanning and occasional IP reputation listing, because the address dey publicly listed as relay. Exit relays na the ones wey dey receive abuse mail and legal notices, and dem need provider wey agree beforehand to handle am. Read your provider terms before you start either type.

Why my new Tor relay no dey get traffic?

Because new relays dey throttled by design until dem measure am. For the first three days, directory authorities dey cap the published weight at 20 KB, so clients almost never choose the relay. Bandwidth authorities dey measure am from around day three. E becomes eligible for the Guard flag around day eight, and traffic drop again at that point because clients dey avoid guards when dem dey choose middle hops. Full load dey arrive around day 68. Confirm say the log show "Self-testing indicates your ORPort is reachable from the outside", then leave am alone.

I fit run Tor relay for VPS wey get 1 TB transfer allowance?

Yes, at about 1 Mbit/s for each direction, wey be RelayBandwidthRate 125 KBytes. That one na roughly 648 GB per month if your provider dey meter both directions, and e leave extra capacity for updates and backups. Add AccountingMax 400 GBytes with AccountingRule sum and AccountingStart month 1 00:00 so the relay go hibernate instead of passing the plan limit. If the provider dey bill outbound only, you fit double the rate.

I need set MyFamily if I dey run only one relay?

No. Family declarations dey help clients avoid building circuit through two relays wey the same operator own, and that no get meaning when na one relay dey. Set am as soon as you add second relay: list every relay fingerprint inside every relay MyFamily line, or use the family key wey Tor 0.4.9 introduce, wey dey distribute one FamilyId instead of list wey dey grow forever.