How to Run Tor Bridge with obfs4 for VPS

Wetin Tor bridge be, and why e dey exist

Tor bridge na entry point into Tor network wey dem no publish im address for public relay list. Dem dey call that list consensus, and na signed document wey anybody fit download; censor sef fit download am. To block Tor from that list no hard: download consensus, then drop every address wey dey inside am for border. Bridges dey exist because the published list na the weak point. Dem dey give out bridge addresses small small, so no single request go hand over the complete set.

Address wey no dey listed na only half of the answer. Deep packet inspection (DPI), wey dey classify traffic by wetin dey inside am instead of the address, fit recognise Tor connection from the shape of im TLS (transport layer security) handshake. Censor wey no get the list still fit see say “this one look like Tor” and drop the connection. Pluggable transport dey remove that signal. E dey wrap Tor stream inside another thing for client side, then your bridge unwrap am.

obfs4 na the transport wey most bridges dey run. E dey turn the stream to bytes wey no get header or fixed handshake, so DPI no get pattern to match. E still dey authenticate the client. The cert= value inside bridge line na key wey client must prove say e hold before bridge go answer at all. This one dey stop active probing: censor wey connect to your address to test whether e dey speak Tor no go get reply and no go learn anything.

Which pluggable transport you suppose run?

• obfs4 need one VPS, two TCP ports, and no domain name. Na the easiest useful thing wey you fit run, and na wetin this guide dey talk about.
• WebTunnel dey hide the connection inside normal HTTPS traffic go one real website. Tor Project list the requirements as static IPv4 address where possible, domain wey you control, working web server like NGINX or Apache, valid TLS certificate, and at least 1 GB of RAM, with 4 GB recommended. E fit networks where random-looking traffic by itself dey suspicious, because country wey allow only small web browsing still dey allow HTTPS.
• Snowflake na different kind contribution. Volunteers dey run short-lived WebRTC proxies, so the entry points dey change all the time and censor no get stable address to block. You no dey operate bridge for am. You dey run proxy, and e no need fixed address.

Start with obfs4. Later, you fit add WebTunnel bridge for second address: if you run both for one IP, one blocked address fit take both of dem down.

Wetin running a bridge go cost you?

[
  {
    "label": "Bridge, minimum",
    "min_upstream_mbit": 1
  },
  {
    "label": "Guard or middle relay, minimum",
    "min_upstream_mbit": 10
  },
  {
    "label": "Guard or middle relay, recommended",
    "min_upstream_mbit": 16
  }
]

As of October 2026, Tor Project dey ask bridge for at least 1 Mbit/s upstream and downstream bandwidth. Dem dey ask guard or middle relay for 10 Mbit/s, and 16 Mbit/s na the recommendation. These na published requirements, no be measurements. New bridge usually dey far below its own minimum for weeks. The same requirements page dey ask relay for at least 100 GByte outbound traffic every month. The smallest plans don already cover this, so read wetin small VPS really cost every month before you choose anything bigger.

The abuse surface small, and na this part people dey get wrong. Bridge na the first hop. Traffic wey leave your server dey go another Tor relay, never go website wey user choose. Your IP address never dey show for stranger web log as the source of request, so complaint mail wey exit relay operators dey handle no go reach here. Still check your provider acceptable use policy, because some hosts dey treat any Tor service as special case. Bridge and onion service be mirror images for this matter: bridge useful only because people fit reach its address and dem go eventually distribute am, while v3 onion service for the same kind VPS useful only while your public IP remain hidden.

One thing wey you no suppose do: change existing public relay into bridge for the same address. Tor Project advice for that case na make you change "IP address, name and fingerprint", because old address don already dey inside consensus wey censors dey download. Bridge wey be public relay last week na bridge wey don already dey blocklist.

Uptime matter pass speed. Relay requirements talk say "if your relay is not running for more than 2 hours a day its usefulness is limited", and bridge dey worse than relay for this matter, because each client get one address and no fallback. Restart go disconnect every user wey dey use am. Set up TCP port check for Uptime Kuma against the obfs4 port, so you go know the day e stop to answer.

Tor Project repository por Tor install

Distribution packages dey behind, and bridge na security software wey suppose dey current. Add the project's own repository first.

sudo apt update
sudo apt install -y apt-transport-https gnupg wget lsb-release
wget -qO- https://deb.torproject.org/torproject.org/A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc | gpg --dearmor | sudo tee /usr/share/keyrings/deb.torproject.org-keyring.gpg >/dev/null

Now write the source file. The Suites: line suppose hold your release codename, so read am from the system instead of typing am from memory.

sudo tee /etc/apt/sources.list.d/tor.sources >/dev/null <<EOF
Types: deb deb-src
URIs: https://deb.torproject.org/torproject.org/
Suites: $(lsb_release -cs)
Components: main
Signed-By: /usr/share/keyrings/deb.torproject.org-keyring.gpg
EOF
sudo apt update
sudo apt install -y tor deb.torproject.org-keyring obfs4proxy

If apt update report say repository no get Release file for your codename, Tor Project no carry that release. Delete /etc/apt/sources.list.d/tor.sources, run sudo apt update again, and install the tor package wey your distribution dey ship. Everything below remain the same.

The obfs4proxy package come from Debian and Ubuntu themselves (version 0.0.14 for Debian 13, as of October 2026). Confirm where the binary land, because na the path go enter the config:

command -v obfs4proxy || command -v lyrebird

Upstream rename the project to lyrebird, so newer package fit install /usr/bin/lyrebird instead. Use whichever path that command print.

Configure bridge for /etc/tor/torrc

BridgeRelay 1
ORPort 8443
ServerTransportPlugin obfs4 exec /usr/bin/obfs4proxy
ServerTransportListenAddr obfs4 0.0.0.0:9443
ExtORPort auto
ContactInfo you@example.com
Nickname PickANickname
BridgeDistribution any

Every line for there get one failure wey dey attach to am, so handle dem one after another.

BridgeRelay 1 tell tor make e send im descriptor go bridge authority instead of public consensus. Na this one line dey make the relay stay unlisted.

ORPort na the real Tor port. E must dey reachable from internet, because tor dey test am and e no go publish descriptor until the test pass.

ServerTransportPlugin give tor the command wey e go run. tor start obfs4proxy as child process and talk to am through pipe, so obfs4proxy no get im own service unit and e never show for systemctl status.

ServerTransportListenAddr fix the port wey obfs4proxy dey listen on. If you leave this line out, obfs4proxy go pick free port when e start. E fit pick another one after most restarts. This mean say every bridge line wey you don give out go still point to port wey nothing dey listen on. Those clients go get refused connection and stop trying.

ExtORPort auto open the extended ORPort, wey obfs4proxy dey use as loopback channel to hand completed connections back to tor together with client address. Tor Project setup guide include am for every bridge, because without am the transport no fit report that address to tor.

ContactInfo and Nickname both public. Use address wey you go dey read, because na through am Tor Project go reach you about bridge wey no dey work. Pick nickname wey no identify you if you prefer make you stay quiet.

BridgeDistribution choose which distributor go give users your address. The accepted values na https, email, telegram, settings, none and any. Use any for your first bridge and allow the system decide. Use none for private bridge wey you dey give out yourself. This one keep the address completely outside public distribution.

Why port choice important

No use 9001 for both ports. Tor Project talk am direct say make you no do am, because 9001 na the traditional ORPort and censors dey scan internet for am. The two ports also must no be the same, because tor and obfs4proxy each dey bind their own listener.

The strongest obfs4 port na 443. Outbound 443 dey open for almost every restricted network, and long-lived connection to am dey look like normal web session. To bind port wey dey below 1024 need one extra step, because obfs4proxy no dey run as root:

sudo setcap cap_net_bind_service=+ep /usr/bin/obfs4proxy
sudo systemctl edit tor@.service tor@default.service

Add these two lines inside every editor wey open:

[Service]
NoNewPrivileges=no

The capability alone no enough. systemd's NoNewPrivileges dey stop process from gaining any privilege wey e parent no get, and file capability na exactly that kind privilege. So obfs4proxy go fail to bind 443 while this setting dey enabled.

If you prefer skip that step, choose one ordinary high port and write am down. Any port wey you choose, no change the obfs4 port later. Bridge line dey tie address, port, fingerprint, and certificate together. So every copy wey already dey inside user's browser go stop working immediately the moment port change.

Open ports for both firewalls

sudo ufw allow 8443/tcp
sudo ufw allow 9443/tcp
sudo ufw status

Both ports suppose dey open, and most providers dey run another firewall for their control panel wey ufw no know anything about. If rule dey exist for the server but e no dey for the panel, bridge go never reachable and e no go ever publish descriptor. If any part of this one new to you, the ufw rules wey fresh VPS need and wetin listening port really be for Linux go explain am. As you dey do that, lock down SSH with keys and hardened sshd config. Bridge wey you no list for server wey still dey use password SSH na still server wey dey use password SSH.

Start am, then read the log

sudo systemctl enable --now tor.service
sudo systemctl restart tor.service
sudo journalctl -e -u tor@default

Debian and Ubuntu release two units. tor.service na small wrapper, while tor@default.service na the process wey dey do the actual work. Na why journalctl -u tor dey look almost empty, while the log wey you need dey under tor@default.

Two lines show say e work:

Self-testing indicates your ORPort is reachable from the outside. Excellent. Publishing server descriptor.
Registered server transport 'obfs4' at '0.0.0.0:9443'

The first one mean say the reachability test pass and the descriptor reach the bridge authority. If e no ever show, something between internet and your server dey drop traffic go the ORPort. The second line must show the port wey you configure. If another port dey there, e mean say tor no apply ServerTransportListenAddr. The common cause na transport name wey no match: e must read obfs4 for both directives.

Confirm say the two listeners dey:

sudo ss -lntp | grep -E 'tor|obfs4|lyrebird'

Wey my bridge line dey?

obfs4proxy dey write one template inside tor data directory:

sudo cat /var/lib/tor/pt_state/obfs4_bridgeline.txt

That directory belong to tor user and e get mode 700, so if you no use sudo, you go get Permission denied. The file get one line for this shape:

Bridge obfs4 <IP ADDRESS>:<PORT> <FINGERPRINT> cert=<CERTIFICATE> iat-mode=0

Replace <IP ADDRESS> with your server public address, <PORT> with the obfs4 port, no be ORPort, and <FINGERPRINT> with the identity fingerprint wey tor write inside its data directory:

sudo cat /var/lib/tor/fingerprint
sudo cat /var/lib/tor/hashed-fingerprint

The first file get your nickname and the identity fingerprint wey suppose dey inside bridge line. The second one get the hashed fingerprint. Na this one you paste inside Relay Search to check whether your bridge dey run and roughly how many clients dey reach am. You no fit use the two interchangeably. Bridge line wey carry the hashed value no match the identity key wey your bridge dey present, so the client go reject the connection wey e just open.

Bridge go take reach users how?

You no dey hand your bridge line give anybody. Once descriptor reach bridge authority, distribution system (rdsys, wey be successor to BridgeDB) go assign your bridge to one distributor, and users go ask that distributor for bridges. As of October 2026, na these routes dey:

• Bridges website for bridges.torproject.org/options, where "Just give me bridges!" go return obfs4 lines immediately. Captcha no dey there: Tor Project remove am when rdsys replace BridgeDB, for change wey e announce for December 2024.
• Email to bridges@torproject.org from Gmail or Riseup address. E go reply with bridge lines. This provider restriction dey because unlimited free accounts fit allow one censor enumerate every bridge.
• Telegram bot @GetBridgesBot. Send /start, then /obfs4 or /webtunnel.
• Tor Browser itself, under Settings then Connection, where "Request bridges" go fetch dem through moat channel.

New bridge go show for Relay Search about three hours after setup. Users fit take much longer: Tor Project own wording be say, "It can take several days or weeks until you see a consistent set of users." If users no show plenty for the first fortnight, na normal; e no mean say fault dey.

If you set BridgeDistribution none, you opt out of everything. The bridge line go then remain for you to send give the people wey need am, through channel wey censor no dey read.

When something no work

No self-testing line for the log. ORPort no dey reachable. Test am from another machine with nc -vz your.ip 8443. If e hang, packets dey get dropped, so check ufw and provider panel. If e refuse connection, tor no dey listen, so check ss -lntp and read the log for config error.

The registered transport show port wey you no pick. tor ignore ServerTransportListenAddr. Transport name must match the one for ServerTransportPlugin exactly, and both must be obfs4.

obfs4proxy no go bind port 443. Confirm the capability with getcap /usr/bin/obfs4proxy, then confirm say the override reach the unit with systemctl show tor@default -p NoNewPrivileges. If e print NoNewPrivileges=yes, your drop-in enter unit wey no dey run.

Nothing dey inside /var/lib/tor/pt_state/. tor no start the transport, meaning say path for ServerTransportPlugin wrong. Compare am with the output of command -v obfs4proxy.

Clients stop connecting after change. Any change to the address or obfs4 port invalidate every bridge line wey you don distribute before. Check whether server public IP change too. Some providers fit do this when dem rebuild the server.

tor no go start at all. Run sudo -u debian-tor tor --verify-config -f /etc/tor/torrc. E go parse the file, print the line wey e object to, and leave the running service as e be.

FAQ

My VPS provider go complain if I run Tor bridge?

Bridge na entry point, so traffic wey dey comot your server go other Tor relays and e no go ever go the site wey user choose. Your IP address no go show for anybody web log as the source of request, and na this one dey cause the complaints wey exit relay operators dey handle. Hosting rules still dey vary, and some providers dey treat any Tor service as special case, so read the acceptable use policy before you start and put address wey you read inside ContactInfo.

How much bandwidth Tor bridge dey use?

The published minimum na 1 Mbit/s up and down, compared with 10 Mbit/s for guard or middle relay. Real use dey start near zero, because your bridge only dey carry traffic for users wey distributor send come am. If you want hard ceiling, set RelayBandwidthRate and RelayBandwidthBurst inside torrc.

Why nobody don connect to my new bridge?

Bridge dey take about three hours before e appear for Relay Search, and Tor Project guidance be say consistent set of users fit take several days or weeks. Check say descriptor publish, wey be the self-testing line for journalctl -u tor@default, search your hashed fingerprint for Relay Search, and confirm say BridgeDistribution no dey set to none.

Make I run obfs4 or WebTunnel?

Run obfs4 if na your first bridge: one VPS, two ports, no domain, no certificate. Run WebTunnel where dem dey block traffic wey look random, because e need domain wey you control, real web server, valid TLS certificate, and at least 1 GB of RAM. Put dem for separate addresses if you run both, because one blocked IP go otherwise remove two bridges at once.

Wetin go happen if I change obfs4 port later?

Every bridge line wey you don already distribute go stop to work. Bridge line dey bind the address, port, fingerprint, and certificate together, so client wey hold the old line go open connection to port wey nothing dey listen on and e go give up. The same thing apply when public IP of the server change. Choose the port during setup and leave am like that.