How to run a Tor relay or bridge on an offshore VPS

Running a Tor relay is one of the few things you can do that improves someone else's privacy rather than your own. The software side is easy: one package, a dozen lines of configuration, a restart. Choosing a VPS for a Tor relay is what catches people out, because most hosts either forbid relays, meter the bandwidth that makes one worth running, or null-route the box the first time an abuse form arrives.

What a Tor relay actually is — guard, middle, bridge and exit

A Tor client builds a circuit through three relays, so no single machine sees both who you are and where you are going. That only holds because volunteers run the machines. The four roles have very different bandwidth and legal profiles.

• Guard (entry) relay — the first hop. Sees the client IP, never the destination. The Guard flag comes only after a relay proves stable.
• Middle relay — the second hop. Sees neither client nor destination, only two other relays. The safest role, and where most start.
• Exit relay — the last hop. Traffic leaves the network from your IP, so your server is what the outside world sees. Real legal exposure.
• Bridge — an unlisted entry point kept out of the public relay list, for people whose government or ISP blocks Tor. Needs very little bandwidth.

If you are unsure, run a middle relay or a bridge. Neither puts your IP at the end of somebody else's traffic, and you can change role later by editing one file.

Why the VPS under your Tor relay decides whether it is useful

Tor does not spread traffic evenly. Directory authorities measure every relay and assign a consensus weight; clients pick relays in proportion to it. A relay on a throttled or capped line is measured as slow, gets a low weight, and carries almost nothing. Hardware barely matters — a relay is a network job, not a compute job — but the pipe and the policy around it do.

• Transfer that is unmetered in practice. A relay sustaining 20 Mbit/s moves terabytes a month each way; on a metered plan that is an overage invoice, not a contribution.
• A host that tolerates privacy infrastructure. Many providers list Tor relays alongside spam in their terms, then suspend on the first complaint.
• Stable uptime. Consensus weight and the Guard flag build slowly and reset when a relay disappears, so a box that reboots weekly never accumulates any.

Picking a VPS for a Tor relay: bridge, middle or 10 Gbps guard

Match the plan to the role, not to your budget. Every plan on the offshore VPS range ships unmetered bandwidth, one IPv4 and a /64 IPv6 block, so the real difference between tiers is port speed and headroom.

• Bridge or modest middle relay: the entry VPS at $3.99/mo — 1 vCPU EPYC, 2 GB DDR5 ECC, 30 GB NVMe Gen4, unmetered 1 Gbps port.
• Serious middle or guard relay: VPS-8 at $13.99/mo — 4 vCPU, 8 GB and an unmetered 2 Gbps port, more than the network sends a mid-weight relay.
• High-consensus-weight relay: the 10 Gbps line from $34.99/mo — a dedicated 10 Gbps port behind 4 vCPU EPYC and 8 GB; $69.99/mo doubles it.

CPU only bottlenecks at high throughput, where TLS and relay cryptography cost cycles. If you run several relays, a dedicated server from $64/mo removes the neighbour question. Location matters too: 14 regions, 8 privacy-tier — Amsterdam, Bucharest, Zurich, Reykjavík, Helsinki, Luxembourg, Kuala Lumpur and Moscow — and spreading relays across networks helps the network.

Step by step: from a crypto top-up to a running relay

1. 01Create an account with a burner emailAn email and a password. No name, phone or ID, so nothing on our side ties the relay to you.
2. 02Top up your balance in cryptoFund a prepaid balance with Bitcoin, Monero or any of 8 coins. It never expires and is never frozen.
3. 03Deploy the VPSPick a plan, a region and a Debian or Ubuntu image. Root access is ready in about a minute at the median.
4. 04Install Tor from the Tor Project repositoryAvoid the distribution package — it lags behind. Add the official apt repository so security updates arrive promptly.
5. 05Write your torrc and open the ORPortSet the role, the port, a nickname and a contact address, then open that port in the firewall.
6. 06Restart tor and read the logIt logs that it published its descriptor and, once reachability is confirmed, that it is now looking good.

Writing your torrc: ORPort, Nickname, ContactInfo and limits

The whole configuration lives in one file, and a non-exit relay needs little in it. The values that matter most control how much of your line Tor may take.

• ORPort — the port other relays and clients connect to. 443 and 9001 are usual; 443 reaches users behind firewalls that only permit web ports.
• Nickname — a short public label. It appears in the public relay list, so pick something that does not identify you.
• ContactInfo — an address the Tor Project can use to reach you. It is published, so use a dedicated one.
• ExitRelay 0 — the explicit switch that keeps you a non-exit relay. Set it deliberately instead of trusting defaults.
• RelayBandwidthRate and RelayBandwidthBurst — a sustained ceiling and a burst allowance, so Tor never crowds out the rest of the box.
• MyFamily — the fingerprints of every other relay you run, so clients never build a circuit through two of your machines.

Running an obfs4 bridge instead, for users behind censorship

To help people in countries that block Tor, a bridge does more good per dollar than a relay. Bridges are not in the public consensus, so a censor cannot download the relay list and block every address. A pluggable transport such as obfs4 goes further, wrapping the connection so traffic analysis sees no recognisable Tor handshake.

Setup is a bridge-mode flag, a plugin line pointing at obfs4proxy, and a second port. Bandwidth needs are small enough that the cheapest plan on the offshore VPS range is adequate, which makes a bridge the best-value contribution most people can make. Two caveats: bridges in heavily surveilled networks do get discovered, and a bridge whose address you post publicly has stopped being one.

Unmetered ports, fair use and what a relay really consumes

A busy relay runs at its ceiling around the clock, in both directions — the profile "unlimited" hosting plans are written to exclude. The 10 Gbps Unmetered plans carry a dedicated port, genuinely unmetered transfer under fair use, no per-terabyte overage and 1.2 Tbps DDoS scrubbing, billed hourly or monthly. Be honest about the ceiling you will reach: the Tor Project asks for roughly 16 Mbit/s each way before a relay is worth listing.

Should you run an exit node? The honest answer

Probably not, certainly not first. An exit relay puts your server IP at the end of other people's traffic. Complaints arrive — copyright notices, scanning reports, occasionally a law-enforcement enquiry — addressed to whoever runs the address. Even in DMCA-relaxed regions that is work you have signed up for, and our AUP still prohibits the genuinely harmful categories regardless of what Tor carried.

If you do it anyway: use an IP that hosts nothing else, publish a clear exit notice, and run a reduced exit policy rather than the default. Exits are needed and undersupplied — but they are an operational commitment, not a weekend project.

Keeping the relay unlinked to you

The relay is public by design, but nothing requires the hosting account behind it to carry your identity. No-KYC hosting removes that layer completely: an email and a password, no verification, nothing on file to request or leak. Paying from a crypto balance removes the bank.

How far you take the payment side is a threat-model question. Bitcoin is pseudonymous, not anonymous — the ledger is public and permanent, so coins traced back to a verified exchange still lead somewhere. Topping up in Monero closes that gap at the protocol level. Either way, the IP you administer from is the one thing no policy can hide: reach it over Tor, or a WireGuard tunnel you control.

Ramp-up, monitoring and the mistakes that leave a relay idle

New relays are almost ignored at first. Authorities must measure yours before trusting it with traffic, so expect very little for a day or two, then a slow climb — longer for a guard, whose flag depends on a record of stability. Restarting resets that progress. Look your relay up by fingerprint on the Tor Project metrics site to confirm it is seen. The failures that keep a relay idle are mundane:

• The ORPort blocked by the firewall, so reachability testing never succeeds and the descriptor is never published.
• RelayBandwidthRate left far too low, capping measured bandwidth and therefore consensus weight.
• Several relays run by one operator without MyFamily set — actively harmful to client anonymity.

What running a relay does — and does not — do for you

Be clear about the benefit. A relay does not anonymise your own traffic and earns you no special treatment from the network. It is a contribution to other people. If you want privacy for yourself, that is a different job: a VPN you run yourself, a Monero node, or a site hosted without KYC. What a relay needs is a host that will not fight you: a port unmetered in practice, and a payment path that does not demand your identity.