A Tor obfs4 bridge setup turns a spare VPS into an unlisted entry point that helps people on censored networks reach Tor. You need a host that allows it, two reachable TCP ports, the Tor Project's packages, a short torrc, and a plan for updates and retirement.

Key Takeaways:

A bridge relays traffic into Tor; it never sends traffic out to websites.

Your provider's terms, bandwidth quota and a public contact address come first.

Both the ORPort and the obfs4 port must be reachable from the internet.

The bridge line is a credential: share it only with the people you intend.

Updates, quota limits and a clean shutdown keep the bridge from becoming a liability.

How is a bridge different from a relay or an exit?

A bridge publishes its descriptor to the bridge database instead of the public directory authorities, so its address is not in the public relay list.［1］ An exit relay sends Tor traffic to destination websites; with ExitRelay 0, no traffic is allowed to exit.［1］ Traffic from your server therefore reaches only other Tor relays, never the websites users visit. Running a bridge is a separate question from protecting your own traffic; compare Tor and VPN trust models for that decision.

The Tor Project's guide sets up obfs4, a pluggable transport that disguises the connection, to help censored users connect.［2］ If you want the user-side background first, read what Tor bridges do for users.

This procedure is based on the official sources listed below; a complete end-to-end test has not been performed. It targets Debian 13 (trixie) x64, where obfs4proxy 0.0.14 is packaged.［3］ For the wider decision about running your own servers, see the self-hosting maintenance overview.

What should you check before a Tor obfs4 bridge setup?

The Tor Project lists two hard requirements: 24/7 internet connectivity and the ability to expose TCP ports to the internet without NAT getting in the way.［2］ A small VPS with a public IPv4 address usually meets both.

Read the provider's acceptable-use policy and ask support if Tor is not mentioned. Policies differ, and some restrict exits or Tor software specifically. Do not hide the purpose from your host.

Check your monthly transfer allowance. AccountingMax caps bytes per accounting period, and when the quota runs out Tor hibernates until the next period.［1］ Also note that ContactInfo is archived, published and indexed by search engines, so use a dedicated address.［1］

Step 1: Prepare Debian and automatic updates

Start from a fresh Debian 13 VPS with SSH key login and a provider console for recovery. Install unattended upgrades as the Tor Project's relay guide describes:［4］

sudo apt-get install unattended-upgrades apt-listchanges

In /etc/apt/apt.conf.d/50unattended-upgrades, make sure the origins include both Debian security updates and the Tor Project:

Unattended-Upgrade::Origins-Pattern {
    "origin=Debian,codename=${distro_codename},label=Debian-Security";
    "origin=TorProject";
};

Then write /etc/apt/apt.conf.d/20auto-upgrades:

APT::Periodic::Update-Package-Lists "1";
APT::Periodic::AutocleanInterval "5";
APT::Periodic::Unattended-Upgrade "1";
APT::Periodic::Verbose "1";

Automatic reboot is optional; decide whether unattended restarts suit this server.［4］

Step 2: Install tor and obfs4proxy from trusted sources

The bridge guide says to configure the Tor Project's repository before installing tor.［2］ Confirm the architecture is amd64 or arm64, then add the signing key:［5］

sudo dpkg --print-architecture
sudo apt install apt-transport-https gnupg
wget -qO- https://deb.torproject.org/torproject.org/A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc | gpg --dearmor | sudo tee /usr/share/keyrings/deb.torproject.org-keyring.gpg >/dev/null

Create /etc/apt/sources.list.d/tor.sources in deb822 format, with trixie as the distribution:［5］

Types: deb deb-src
URIs: https://deb.torproject.org/torproject.org/
Suites: trixie
Components: main
Signed-By: /usr/share/keyrings/deb.torproject.org-keyring.gpg

sudo apt update
sudo apt install tor deb.torproject.org-keyring obfs4proxy

The Debian package installs the transport at /usr/bin/obfs4proxy, which tor launches as a managed helper process.［3］

Step 3: Write the obfs4 bridge torrc

Replace the contents of /etc/tor/torrc. The Tor Project's template uses an ORPort, an obfs4 port that differs from it, and an automatic Extended ORPort; avoid port 9001, which is commonly associated with Tor.［2］

BridgeRelay 1
ORPort 9443
ServerTransportPlugin obfs4 exec /usr/bin/obfs4proxy
ServerTransportListenAddr obfs4 0.0.0.0:8443
ExtORPort auto
ExitRelay 0
ContactInfo bridge-admin@example.org
Nickname ExampleBridge

Change both ports, the contact address and the nickname. ExitRelay 0 makes the no-exit intent explicit.［1］ Ports below 1024, such as 443, need an extra capability and systemd change described in the guide; ports above 1024 avoid that.［2］

Two optional lines matter for operators:

Option	Effect	When to use it
`BridgeDistribution none`	BridgeDB does not hand out your address; default is `any`	Private bridge for people you know
`AccountingMax 500 GBytes` plus `AccountingStart month 1 00:00`	Hibernates after the quota each month	Plans with a hard transfer cap

Both behaviors come from the tor manual; pick quota values that match your plan.［1］

Step 4: Open both ports and start tor

Both the ORPort and the obfs4 port must be reachable, and both must be open in any firewall or NAT in front of the server.［2］ Allow inbound TCP to the two ports in the provider's cloud firewall and in any host firewall, keeping your SSH rule.

sudo systemctl enable --now tor.service
sudo systemctl restart tor.service
sudo ss -lntp | grep -E ':(9443|8443) '

Both ports should show listeners. If one is missing, check the torrc for typos before touching the firewall.

Step 5: Read the logs and test reachability

sudo journalctl -e -u tor@default

A healthy bridge logs its identity key fingerprint, its hashed identity key fingerprint, and a line saying it registered the obfs4 server transport.［2］ The log also reports whether the ORPort is reachable. For the obfs4 port, use the reachability test at bridges.torproject.org/scan/.［2］

Check method	Expected observation	If it fails
`journalctl` after restart	Fingerprint lines and obfs4 registration	Fix torrc syntax or the obfs4proxy path
ORPort self-test in the log	Reported reachable	Open TCP in the cloud firewall
Scan of the obfs4 port	Reported reachable	Open the obfs4 port; confirm `0.0.0.0`
Relay Search with the hashed fingerprint	Bridge appears after about three hours	Wait, then recheck logs

Relay Search takes roughly three hours to list a new bridge, and a consistent set of users can take several days or weeks.［6］

Step 6: Build the Tor bridge line and protect it

On Debian, tor writes the client parameters to /var/lib/tor/pt_state/obfs4_bridgeline.txt.［6］［3］

sudo cat /var/lib/tor/pt_state/obfs4_bridgeline.txt

The line has the form Bridge obfs4 <IP ADDRESS>:<PORT> <FINGERPRINT> cert=<CERTIFICATE> iat-mode=0. Fill in the server's public IP, the obfs4 port rather than the ORPort, and the identity key fingerprint rather than the hashed one.［6］

Treat the completed line like a password. Anyone holding it can connect, and anyone who wants to block the bridge only needs that line. With BridgeDistribution none, send it privately and only to people you intend.

Step 7: Maintain, move or retire the bridge

Check the update path monthly without changing anything:［4］

sudo unattended-upgrade --debug --dry-run

The obfs4 state file obfs4_state.json in pt_state holds the generated parameters, so keeping /var/lib/tor keeps the same certificate.［3］ If you move to a new IP address, regenerate and redistribute the bridge line. When converting a former public relay into a bridge, the Tor Project advises changing its IP address, name and fingerprint.［7］

To retire, warn anyone you gave the line, then stop the service and close both ports:

sudo systemctl disable --now tor.service

Delete /var/lib/tor only if you never want to reuse that identity, and remove the repository file if nothing else needs it.

Summary

Confirm the host allows Tor bridges and budget your transfer quota.
Install tor from the Tor Project repository and obfs4proxy from Debian.
Use a short torrc with two distinct, reachable ports and no exit.
Verify logs, the scan and Relay Search before sharing anything.
Keep updates running and retire the bridge deliberately.

FAQ

Will running a bridge make my own browsing anonymous?

No. A bridge helps other people enter Tor. Your own traffic still needs its own tool, and stacking tools changes who you trust; see how Tor over VPN orders the hops.

Is a bridge the same as an exit relay?

No. A bridge only carries traffic into the Tor network; with no exit configured, nothing leaves your server toward websites.

Do I need to open two ports?

Yes. The guide requires both the ORPort and the obfs4 port to be reachable from the internet, or the bridge will not work properly.

Why does nobody use my bridge yet?

Relay Search lists new bridges after about three hours, and steady usage can take several days or weeks to appear.

Can I keep my bridge private?

Yes. Set BridgeDistribution none so BridgeDB does not hand out the address, then share the bridge line only with trusted people.

What happens when I hit my bandwidth cap?

With AccountingMax set, tor stops accepting new connections as the quota runs low and hibernates until the next accounting period.

Can I run a bridge at home instead of on a VPS?

It is possible only with 24/7 uptime and TCP ports exposed without NAT problems; many home connections fail one of those requirements.

Disclaimer: Rules for running Tor infrastructure vary by host and jurisdiction. This guide is general technical information, not legal advice; check your provider's terms and the law that applies to you.

Sources:

tor(1) manual, Debian trixie — https://manpages.debian.org/trixie/tor/tor.1.en.html
Tor Project: Bridge on Debian/Ubuntu — https://community.torproject.org/relay/setup/bridge/debian-ubuntu/
obfs4proxy(1) manual, Debian trixie — https://manpages.debian.org/trixie/obfs4proxy/obfs4proxy.1.en.html
Tor Project: Relay Automatic Updates — https://community.torproject.org/relay/setup/guard/debian-ubuntu/updates/
Tor Project: Debian Repository — https://support.torproject.org/apt/tor-deb-repo/
Tor Project: Bridge Post-install — https://community.torproject.org/relay/setup/bridge/post-install/
Tor Project: Bridge Setup Overview — https://community.torproject.org/relay/setup/bridge/

Sources checked 14 October 2026.

Related Articles:

Tor obfs4 Bridge Setup on a VPS: Install, Check, Maintain