Hello,
I’ve created a new Tor bridge in a FreeBSD jail, but the bridge status page tells me:
Bridge 4AD2EEA276C672B07B34E979A6109B97632ACA62 advertises:
* obfs4 IPv4: dysfunctional
Error: Bridge address is not valid
Last tested: 2025-11-24 01:44:16.48515592 +0000 UTC m=+457200.694247420 (16m23.431500714s ago)
The configuration is basically the same as what appears in the instructions for a FreeBSD bridge:
RunAsDaemon 1
BridgeRelay 1
# Replace "TODO1" with a Tor port of your choice. This port must be externally
# reachable. Avoid port 9001 because it's commonly associated with Tor and
# censors may be scanning the Internet for this port.
ORPort 9846 IPv4Only
ServerTransportPlugin obfs4 exec /usr/local/bin/obfs4proxy
# Replace "TODO2" with an obfs4 port of your choice. This port must be
# externally reachable and must be different from the one specified for ORPort.
# Avoid port 9001 because it's commonly associated with
# Tor and censors may be scanning the Internet for this port.
ServerTransportListenAddr obfs4 0.0.0.0:9921
# Local communication port between Tor and obfs4. Always set this to "auto".
# "Ext" means "extended", not "external". Don't try to set a specific port
# number, nor listen on 0.0.0.0.
ExtORPort auto
# Replace "<address@email.com>" with your email address so we can contact you if
# there are problems with your bridge. This is optional but encouraged.
ContactInfo REDACTED
# Pick a nickname that you like for your bridge. This is optional.
#Nickname PickANickname
Log notice file /var/log/tor/notices.log
I think the only substantive change I’ve made to that config is setting the port numbers and adding IPv4Only, since the jail doesn’t have IPv6 configured and it was failing to start without that because it was trying to create an IPv6 listener.
I should note that this host is behind NAT, so the system’s IP address is in private IP space, and is not its public IP address. The public IP address is also dynamic, so although I can build some automation to reconfigure Tor and restart when it changes, it would be great if it’s possible for Tor to handle that gracefully on its own. I do have both the ORPort and obfs4 ports successfully forwarded, as confirmed by both the Tor TCP Reachability Test as well as my own testing from remote hosts opening the raw sockets.
I’ve tried several variations, including a different ORPort configuration:
ORPort 9846 IPv4Only
Address <DNS_NAME_OF_MY_HOST>
Alternately, I tried:
ORPort <PUBLIC_IP_OF_MY_HOST>:9846 NoListen
ORPort <LOCAL_IP_OF_MY_HOST>:9846 NoAdvertise
…but despite leaving for a few hours, neither resolved the error on the bridge status page.
I did find this similar post here, but its solution is already included in the configuration I’m using now.
Can anyone advise on what the correct configuration is for a bridge behind NAT is? I’ve exhausted all the suggestions I can find by searching and world appreciate any help. Thank you!
