# Obfs4 ports explained

**URL:** <https://forum.torproject.org/t/obfs4-ports-explained/14179>\
**Category:** Relay Operator\
**Created:** [August 19, 2024, 5:22am UTC](https://forum.torproject.org/t/obfs4-ports-explained/14179 "2024-08-19T05:22:32Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![SirNeo](https://forum.torproject.org/user_avatar/forum.torproject.org/sirneo/32/1933_2.png) [@SirNeo](https://forum.torproject.org/u/SirNeo)\
**Post date:** [August 19, 2024, 5:22am UTC](https://forum.torproject.org/t/obfs4-ports-explained/14179/1 "2024-08-19T05:22:32Z")

</div>

I will continue thread from [here](https://forum.torproject.org/t/obfs4-port-meaning/10822) and the mailing list from [here](https://forum.torproject.org/t/tor-relays-obfs4-bridge-current-setup-is-not-entirely-clear/10149)

Without ORPORT exposed to the internet i got this

11:49:55 [WARN] Your server has not managed to confirm reachability for its ORPort(s) at XXX:2024. Relays do not publish descriptors until their ORPort and DirPort are reachable. Please check your firewalls, ports, address,  
/etc/hosts file, etc.

And on [bridges.torproject.org/status?id=bridgeid](http://bridges.torproject.org/status?id=bridgeid) i received the “no resources for the given id”

All this after 24h of running the bridge

Now i have done the port forwarding and i can see this message in the log, hopefuly in 1-2h i can check again the bridgedb.

12:05:57 [NOTICE] Self-testing indicates your ORPort XXXX:2024 is reachable from the outside. Excellent. Publishing server descriptor.

So is it seems both ports need to be exposed in the internet

---

<div class="post-metadata">

**Author:** ![meskio](https://forum.torproject.org/user_avatar/forum.torproject.org/meskio/32/26_2.png) [@meskio](https://forum.torproject.org/u/meskio)\
**Post date:** [August 19, 2024, 10:59am UTC](https://forum.torproject.org/t/obfs4-ports-explained/14179/2 "2024-08-19T10:59:43Z")

</div>

Yes, the tor daemon expect to have the ORPort reachable and will give an error if is not. You can add `AssumeReachable 1` to your torrc so it will assume the ORPort is reachable, will skip this check and publish the bridge descriptor. Doing that you can run a bridge without publishing the ORPort.

We plan to make this the recommended way to run bridges but haven’t updated the documentation yet: [Recommend not exposing OrPort for bridges (#129) · Issues · The Tor Project / Anti-censorship / Team · GitLab](https://gitlab.torproject.org/tpo/anti-censorship/team/-/issues/129)

---

<div class="post-metadata">

**Author:** ![SirNeo](https://forum.torproject.org/user_avatar/forum.torproject.org/sirneo/32/1933_2.png) [@SirNeo](https://forum.torproject.org/u/SirNeo)\
**Post date:** [August 19, 2024, 12:54pm UTC](https://forum.torproject.org/t/obfs4-ports-explained/14179/3 "2024-08-19T12:54:59Z")

</div>

Thanks, I will do that right away because my feeling is that censors discovery my bridge using the vanilla port (ORport) and ban the entire class so obfs4 becomes obsolete

---

<div class="post-metadata">

**Author:** ![system](https://forum.torproject.org/uploads/default/original/2X/d/d3424bed34f4ec18b2e99178c2801ba6dfb655d6.png) [@system](https://forum.torproject.org/u/system)\
**Post date:** [August 20, 2024, 12:55pm UTC](https://forum.torproject.org/t/obfs4-ports-explained/14179/4 "2024-08-20T12:55:00Z")

</div>

Closed on August 20, 2024, 12:55pm UTC

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.