(Tor) Set up an obfs4 bridge

24/7 Internet connectivity
The ability to expose TCP ports to the Internet (make sure that NAT doesn't get in the way)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42

# This file assists operators in (re-)deploying an obfs4 bridge Docker
# container.  You need the tool 'docker-compose' to use this file.  You
# can find it in the Debian package 'docker-compose'.
#
# First, you need to create a configuration file, ".env", in the same directory
# as this file, "docker-compose.yml".  Add the following environment variables
# to this configuration file.  EMAIL is your email address; OR_PORT is your
# onion routing port; and PT_PORT is your obfs4 port:
#
#   EMAIL=you@example.com
#   OR_PORT=XXX
#   PT_PORT=XXX
#
# Next, pull the Docker image, by running:
#
#   docker-compose pull obfs4-bridge
#
# And finally, to (re-)deploy the container, run:
#
#   docker-compose up -d obfs4-bridge

version: "3.4"
services:
  obfs4-bridge:
    image: thetorproject/obfs4-bridge:latest
    environment:
      # Exit with an error message if OR_PORT is unset or empty.
      - OR_PORT=${OR_PORT:?Env var OR_PORT is not set.}
      # Exit with an error message if PT_PORT is unset or empty.
      - PT_PORT=${PT_PORT:?Env var PT_PORT is not set.}
      # Exit with an error message if EMAIL is unset or empty.
      - EMAIL=${EMAIL:?Env var EMAIL is not set.}
    volumes:
      - data:/var/lib/tor
    ports:
      - ${OR_PORT}:${OR_PORT}
      - ${PT_PORT}:${PT_PORT}
    restart: unless-stopped

volumes:
  data:
    name: tor-datadir-${OR_PORT}-${PT_PORT}

1
2
3
4
5
6

# Your bridge's Tor port.
OR_PORT=X
# Your bridge's obfs4 port.
PT_PORT=Y
# Your email address.
EMAIL=Z

1

docker-compose up -d obfs4-bridge

1

Starting docker-obfs4-bridge_obfs4-bridge_1 ... done

1

docker-compose up -d obfs4-bridge

1

docker logs CONTAINER_ID

1

docker exec CONTAINER_ID get-bridge-line

1

obfs4 1.2.3.4:1234 B0E566C9031657EA7ED3FC9D248E8AC4F37635A4 cert=OYWq67L7MDApdJCctUAF7rX8LHvMxvIBPHOoAp0+YXzlQdsxhw6EapaMNwbbGICkpY8CPQ iat-mode=0

1
2
3
4
5
6
7
8
9
10

Congrats!

If you get to this point, it means that your obfs4 bridge is running and is being distributed by BridgeDB to censored users. Note that it can take several days or weeks until you see a consistent set of users, so don't get discouraged if you don't see user connections right away. BridgeDB uses four buckets for bridge distribution: HTTPS, Moat, Email, and manual. Some buckets are used more than others, which also affects the time until your bridge sees users. Finally, there aren't many bridge users out there, so you cannot expect your bridge to be as popular as a relay.

If you want to connect to your bridge manually, you will need to know the bridge's obfs4 certificate. See the file /var/lib/tor/pt_state/obfs4_bridgeline.txt and paste the entire bridge line into Tor Browser:

Bridge obfs4 <IP ADDRESS>:<PORT> <FINGERPRINT> cert=<CERTIFICATE> iat-mode=0
You'll need to replace <IP ADDRESS>, <PORT>, and <FINGERPRINT> with the actual values, which you can find in the tor log. Make sure to use <FINGERPRINT>, not <HASHED FINGERPRINT>; and that <PORT> is the obfs4 port you chose - and not the OR port.

Finally, you can monitor your obfs4 bridge's usage on Relay Search. Just enter your bridge's <HASHED FINGERPRINT> in the form and click "Search". After having set up the bridge, it takes approximately three hours for the bridge to show up in Relay Search.

(Tor) Set up an obfs4 bridge

Bridge set up guide

Set up bridge by using Docker

1. Deploy a container

2. Upgrade your container

3. Monitor your logs

post-install notes

our help section