TOR BRIDGE :: OBFUSCATED ENTRY NODE

> A discreet entry point into the Tor network.
> Built to help people bypass censorship and reach the open internet.

TL;DR: Running a Tor bridge helps fight censorship.

WHAT IS A TOR BRIDGE?

A Tor bridge is a small, less-visible entry point into the Tor network. Its main purpose is to help people who cannot connect to Tor normally because their country, ISP, school, company, or local network blocks public Tor relays.

Unlike a regular public Tor relay, a bridge is not listed in Tor's main public directory. This makes it harder to block at scale. Users who need bridges get bridge addresses through specific distribution channels, then connect to Tor through those less-visible entry points.

WHY IT MATTERS

Bridges help users reach Tor even when public relays are blocked. This is especially useful in restricted or heavily filtered networks.

OBFS4

obfs4proxy disguises Tor bridge traffic, making the bridge more useful against censorship and network filtering.

PREPARE THE RASPBERRY PI

cluster@bridge:~$ update-system

sudo apt update
sudo apt full-upgrade -y
sudo reboot

After the reboot:

sudo apt install unattended-upgrades apt-listchanges -y
sudo dpkg-reconfigure unattended-upgrades

Answer Yes. The Tor Project recommends automatic security updates to keep relays and bridges secure.

INSTALL TOR AND OBFS4PROXY

sudo apt update
sudo apt install tor obfs4proxy -y

obfs4proxy is used to disguise Tor traffic and make the bridge more useful against censorship.

BACK UP THE CURRENT TOR CONFIGURATION

sudo cp /etc/tor/torrc /etc/tor/torrc.bak

Then edit the Tor configuration file:

sudo nano /etc/tor/torrc

You can replace its content with this:

## Tor obfs4 Bridge - Raspberry Pi

BridgeRelay 1

## Never run as an exit relay
ExitRelay 0
ExitPolicy reject *:*

## No local SOCKS proxy
SocksPort 0

## Classic Tor bridge port
## Must be reachable from the internet
ORPort 9002

## obfs4 transport
ServerTransportPlugin obfs4 exec /usr/bin/obfs4proxy

## Public obfs4 port
## Must be different from ORPort
ServerTransportListenAddr obfs4 0.0.0.0:9443

## Internal port between Tor and obfs4
ExtORPort auto

## Bandwidth limit
## 4 Mbit/s is approximately 500 KBytes/s
RelayBandwidthRate 500 KBytes
RelayBandwidthBurst 500 KBytes

AccountingStart day 03:00
AccountingMax 5 GBytes

## Optional but useful
Nickname XXXXXXXXX

## Optional but recommended by Tor for contact in case of issues
## You can use an alias or Proton address
ContactInfo admin@example.com

Replace these values with your own:

Nickname XXXXXXXXX
ContactInfo admin@example.com

For this kind of bridge, the expected options are BridgeRelay, ORPort, ServerTransportPlugin obfs4, ServerTransportListenAddr obfs4, and ExtORPort auto. Both the ORPort and the obfs4 port must be reachable from the internet.

OPEN PORTS ON THE RASPBERRY PI

Use sudo ufw allow 22/tcp only if you want SSH to be reachable more broadly. A safer option is to allow SSH only from your admin PC.

sudo apt install ufw -y
sudo ufw allow from YOUR_PC_IP to any port 22 proto tcp
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 9002/tcp
sudo ufw allow 9443/tcp
sudo ufw enable
sudo ufw status verbose

FORWARD PORTS ON YOUR ROUTER

Create two NAT port forwarding rules to the local IP address of the Raspberry Pi.

TCP 9002  -> 192.168.10.X:9002
TCP 9443  -> 192.168.10.X:9443

RESTART TOR

sudo systemctl enable tor
sudo systemctl restart tor
sudo systemctl status tor --no-pager

The service should be active (running).

CHECK THE LOGS

sudo journalctl -u tor -e

If the following lines appear, the bridge is working correctly:

Bootstrapped 100%: Done
Registered server transport 'obfs4'
Self-testing indicates your ORPort is reachable from the outside
Publishing server descriptor

SOURCE

Source: Tor Project - Debian / Ubuntu Bridge Setup

BACK CONTACT