Setting up a Tor proxy, relay and hidden service

Go back to articles list

Contents

  1. Introduction
  2. Installation
  3. Configuration
    1. Tor SOCKS/HTTP proxy
    2. Tor relay
    3. Hidden service
  4. Miscellaneous
    1. Nyx — status monitor for Tor nodes
    2. Notes

1. Introduction

In this article I’ll show you how to setup your own Tor proxy (SOCKS5 and HTTP), relay, and hidden service.

2. Installation

Install tor package using your package manager.

You definitely want to have control over your node and monitor it. For that purpose there is nyx tool. I’ll cover it in 3.1 section.

Any program can be passed through Tor using torify from torsocks package.

3. Configuration

Tor is already bundled with a great documented torrc-dist file. You may just copy a torrc-dist file and name it as torrc and change what you need.

3.1. Tor SOCKS/HTTP proxy

Here is an example of SOCKS/HTTP proxy settings:

SocksPort 192.168.0.100:9050, [ipv6 address]:9050
HTTPTunnelPort 192.168.0.100:8118, [ipv6 address]:8118

SocksPolicy accept 192.168.0.0/24
SocksPolicy accept6 [012:3fe1:337::]/48
SocksPolicy reject *

BandwithRate 70MBits
BandwithBurst 100MBits

ExcludeNodes {ru}, {ua}, {by}, {kz}, {??}
ExcludeExitNodes {ru}, {ua}, {by}, {kz}, {??}

SocksPort assigns IP-address and port for SOCKS5 proxy to listen on. HTTPTunnelPort is for HTTP proxy. You may leave just port number to listen on all interfaces.

SocksPolicy option has the form accept|reject IP-subnet[, .... It points which subnetwork is dis-/allowed to use SOCKS proxy, so there may be multiple entries. For example, SocksPolicy accept 192.168.1.0/24 is allowing everyone from that network to use it. In order to forbid all other networks add reject * after all SocksPolicy entries. You may preffer to have them on separate lines for the sake of readability.

BandwithRate and BandwithBurst set the average and maximum speed of incoming and outgoing connections for proxy. BandwithBurst must be greater or equal to BandwithRate. E.g. values may look like 70MBits, 10MBytes, 5MB.

HTTPTunnelPort enables HTTP proxy, set it to desireable IP:Port.

There are also ExcludeNodes and ExcludeExitNodes options that are the comma separated lists of forbidden nodes. There may be placed country codes, address patterns and identity fingerprints of nodes to never use in circuits. They are looking like {ru}, {??}, 123.45.*. I recommend to leave there at least {??} to forbid misconfigured nodes or nodes of an unknown origin, especially for exit nodes.

3.2. Tor relay

Here is an example of relay settings.

ORPort 8443, [::]:8443
Nickname Anon
Address example.org
ContactInfo Anon <anon@example.org>

RelayBandwithRate 8MBits
RelayBandwithBurst 10MBits

AccountingMax 6 GB
# Every midnight.
AccountingStart day 00:00
# Every 3rd day of month.
AccountingStart month 3 00:00

# In case you don't want to be an exit node.
ExitPolicy reject *:*

To enable a Tor relay you need to set ORPort option.

You should also provide some information. You have to set Nickname option that is a name of a relay. Also, optionally, yet recommended, you may fill ContactInfo option with your e-mail address.

If you leave your e-mail address Tor weather service will send you a notification if your node goes down.

You can also set Address option if you have a domain name or set it to your white IP-address. Otherwise, if you don’t add it or comment out it, Tor will guess it.

RelayBandwithRate and RelayBandwithBurst are the same as BandwithRate and BandwithBurst but for relay.

Add ExitPolicy reject *:* to disable exit node if you don’t need it. I found out that setting ExitRelay to 0 doesn’t disable an exit node, so you must add rejecting policy.

AccountingMax and AccountingStart are used to limit traffic for given period.

3.3. Hidden service

There are two mandatory options to work with: HiddenServiceDir and HiddenServicePort.

Of course, there are many other options, e.g. client authentication. But in simple case all you need are those two options above.

Every hidden service starts with HiddenServiceDir <path> directory that contains public and secret keys, hostname for a hidden service and a directory called authorized_clients that stores info on all clients that are authorized to access this hidden service.

And at least one HiddenServicePort <tor port> <host:port of service> sets port to listen to in Tor network as first parameter and the second one is a service that you want to give access from Tor to. E.g. HiddenServicePort 80 localhost:8201 for webserver.

It allows you to give access to many services by one Tor hostname.

Example:

HiddenServiceDir /var/lib/tor/hidden-services/website
HiddenServicePort 80 localhost:8201
HiddenServicePort 25 192.168.1.160:25

4. Miscellaneous

4.1. Nyx — status monitor for Tor nodes

You have to set ControlPort option to desired port, it will listen on localhost. If you need access from outside then set it to IP:9051. Also, you need to set DisableDebuggerAttachment option to 0, otherwise you’ll not be able to use nyx. At least in my case nyx cannot connect with this option being set to 1.

Example:

ControlPort 192.168.1.200:9051
DisableDebuggerAttachment 0

You may install it using package manager, but guaranteed last version can be installed from Python’s pip package manager (pip install nyx).

4.2. Notes

I hope you have a static IP-address or your IP changes once a month at least, otherwise you’ll never become a guard (entry) node.

An option AvoidDiskWrites is usefull in case you’re running from SSD or SD card.

You have to make a backup of /var/lib/tor/keys folder to save your node’s cryptographic identity keys. They are used to identify your node. You can see stats on your node at metrics.torproject.org. To find your node use what you put in Nickname parameter or a fingerprint that is shown in nyx.