Some Questions About Running bridges And relays

Hello everyone!

I’m going to run Tor relays and bridges on Oracle Free Tier. But I have some questions about torrc config and abuse issues.

  1. Does Oracle Cloud allow to run Tor bridges and relays on instances?
  2. Should I use AMD architecture or ARM architecture?
  3. What kind of configuration should the instances require, such as how many CPU cores, how much running memory, and how big the hard disk should be?
  4. My instance have an IPv6 addresses. How can I configure torrc so that the bridges and relays support IPv6?
  5. Are there any security issues that need to be paid attention to, such as ssh and firewall configuration of the instances?
  6. I understand that Tor relays can be configured with some traffic policies. How can I configure them?

Hi Leslie.

  1. You’ll need to open a ticket with Oracle Cloud and ask them if it would break their Acceptable Use Policy. There are certainly many relays running on Oracle Cloud (Relay Search) but there’s only one way to know for sure, by asking them.

  2. I have never used AMD on a Tor relay. Just to make life simpler, I’ll suggest ARM.

  3. There’s a lot to unpack with this question. In my experience, hard drive doesn’t matter as long as there’s enough space for the operating system plus another 10GB. If you have more than one CPU core, then you can set NumCPUs on your torrc file to more than 1. My general rule of thumb is 2GB of memory per Tor instance. If you have a ton of memory available, you can run up to two Tor instances per IP address. So let’s say you have one IP address, 4GB of memory and 4 CPU cores, I would personally run two Tor instances with both having NumCPUs set to 2.

  4. You can absolutely configure it to utilize your IPv6 address. If you’re running an exit relay, set IPv6Exit to 1 in your torrc config. Otherwise, take a look at [tor-relays] Call for Testing - New Feature: Relay IPv6 Address Discovery for more information. In general, I find that everything happens automagically and if you have IPv6 setup correctly, your relay will report its availability without any special configuration needed.

  5. Yes, absolutely. Take some time to research “Linux Server Hardening” on a search engine of your choice. Look into SSH public key authentication, fail2ban and best security practices. All of these apply to your relay.

  6. Yep, there is such thing as an Exit Policy. This applies to you if you’re running an exit relay and just like all the other configuration, is set in your instance’s torrc file. There is a write-up about this on the Tor support wiki I suggest you take a look at.

I personally run a highly reduced exit policy:

ExitPolicy accept *:20-21
ExitPolicy accept *:43
ExitPolicy accept *:53
ExitPolicy accept *:80-81
ExitPolicy accept *:443
ExitPolicy accept *:5222-5223
ExitPolicy accept *:6667-7000
ExitPolicy accept *:8008
ExitPolicy accept *:8082
ExitPolicy accept *:8332-8333
ExitPolicy accept *:8888
ExitPolicy accept *:9418
ExitPolicy accept *:50002
ExitPolicy accept *:64738
ExitPolicy accept *:18080-18081

Let me know if you have any questions and welcome to the Tor relay operator community!

3 Likes

Thanks for your answer. I’ve asked Oracle Support Team about running a Tor relay on their instance and I’ve received a reply. It’s OK to run bridges and guard/middle relays. But it is not allowed to run exit relays. I am currently trying to run an obfs4 bridge on an ARM instance with 1 CPU core and 6GB of RAM. Hope everything is well.

By the way, I see you mentioned that you can run two Tor processes on one instance, so I wanted to ask how you can achieve this. I want to run a bridge and a relay at the same time on an ARM-based 2-core CPU and 12GB RAM instance, how should I do this?

Hi Leslie,

Yes, you can run both a Tor bridge and a relay on the same instance. To do this, you need to run two separate Tor processes, each with its own configuration file and data directory.

Here’s the general approach:

Copy the default Tor configuration file and create one for the bridge and another for the relay. Each should have its own unique settings, such as different ports and data directories.
Start each process manually using the tor command with the respective configuration file. Alternatively, you can set up systemd services to manage and automatically start both instances.
Since running both a bridge and a relay can be resource-intensive, especially on an ARM instance, keep an eye on CPU and memory usage to ensure your instance handles the load effectively.

By separating their configurations and directories, both Tor processes can coexist without conflict. Hope this will be help for you :slight_smile:

From Expectations for Relay Operators:

1. Keep users safe

  • Running a bridge and a public relay using the same IP address is discouraged as censored users won’t be able to connect to the network.
1 Like

Hi Gus,

Thanks for the update. I’m also a new relay operator. this is good to know. Thanks again :slight_smile:

2 Likes