OPENING TOR MIDDLE RELAY MANUAL...
LOADING NON-EXIT ROUTING MODE...
STATUS: READY

BACK

TOR MIDDLE RELAY :: NON-EXIT NODE

> A public Tor relay that forwards encrypted Tor traffic inside the network.
> It helps increase Tor capacity without acting as an exit relay.

TL;DR: Running a middle relay helps strengthen Tor without exposing your IP as a Tor exit point.

WHAT IS A TOR MIDDLE RELAY?

A Tor middle relay is a public relay used inside Tor circuits. It forwards encrypted Tor traffic between other Tor nodes, but it does not send traffic directly to the final destination on the internet.

Because it is not an exit relay, external websites and services do not see your relay IP as the source of user traffic. Your relay contributes bandwidth, stability, and resilience to the Tor network while keeping ExitRelay 0.

WHY IT MATTERS

Middle relays increase Tor capacity and make the network faster, stronger, and harder to disrupt.

NON-EXIT MODE

With ExitRelay 0, the relay does not act as a Tor exit node and does not connect directly to destination websites.

PREPARE THE RASPBERRY PI

cluster@relay:~$ update-system

sudo apt update
sudo apt full-upgrade -y
sudo reboot

After the reboot:

sudo apt install unattended-upgrades apt-listchanges -y
sudo dpkg-reconfigure unattended-upgrades

Answer Yes. Automatic security updates help keep the relay secure over time.

INSTALL TOR

sudo apt update
sudo apt install tor -y

BACK UP THE CURRENT TOR CONFIGURATION

sudo cp /etc/tor/torrc /etc/tor/torrc.bak

Then edit the Tor configuration file:

sudo nano /etc/tor/torrc

You can replace its content with this:

## Tor Middle Relay - Raspberry Pi

## Relay identity
Nickname XXXXXXXXX
ContactInfo admin@example.com

## Public Tor relay port
## Must be reachable from the internet
ORPort 9001

## Never run as an exit relay
ExitRelay 0
ExitPolicy reject *:*

## No local SOCKS proxy
SocksPort 0

## Bandwidth limit
## 4 Mbit/s is approximately 500 KBytes/s
RelayBandwidthRate 500 KBytes
RelayBandwidthBurst 500 KBytes

## Optional daily traffic cap
AccountingStart day 03:00
AccountingMax 5 GBytes

Replace these values with your own:

Nickname XXXXXXXXX
ContactInfo admin@example.com

The Tor Project setup for a Debian/Ubuntu middle or guard relay uses Nickname, ContactInfo, ORPort, ExitRelay 0, and SocksPort 0. The ContactInfo field is public.

OPEN PORTS ON THE RASPBERRY PI

Use a restricted SSH rule when possible. Replace YOUR_PC_IP with the IP address of your admin workstation.

sudo apt install ufw -y
sudo ufw allow from YOUR_PC_IP to any port 22 proto tcp
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 9001/tcp
sudo ufw enable
sudo ufw status verbose

FORWARD THE ORPORT ON YOUR ROUTER

Create one NAT port forwarding rule to the local IP address of the Raspberry Pi.

TCP 9001  -> 192.168.10.X:9001

The Tor Project recommends using ORPort 443 when available because it is often allowed on restricted networks. 9001 is also commonly used. Use the same port in your firewall, router forwarding rule, and torrc.

RESTART TOR

sudo systemctl enable tor
sudo systemctl restart tor
sudo systemctl status tor --no-pager

The service should be active (running).

CHECK THE LOGS

sudo journalctl -u tor -e

If the following lines appear, the relay is working correctly:

Self-testing indicates your ORPort is reachable from the outside. Excellent.
Publishing server descriptor.

POST-INSTALL NOTES

A new relay may take some time before it appears in Tor Relay Search and before traffic ramps up. Keep the relay online as much as possible and monitor logs, updates, and bandwidth usage.

SOURCE

Source: Tor Project - Debian / Ubuntu Middle or Guard Relay Setup
Source: Tor Project - Relay Post-install and Good Practices

BACK CONTACT