More Raspberry Pi Projects

Project 6 — Tor Relay

Ethics, Legality, and Who Should Run This

How Tor Works

When someone uses the Tor Browser, their traffic is wrapped in three layers of encryption and routed through three volunteer-operated relays before reaching its destination. Each relay decrypts one layer — like peeling an onion — and forwards the traffic to the next hop. No single relay knows both the origin and destination of any connection.

Relay Types — Why We're Running a Middle Relay

What You Will Need

Step 1 — Install Tor

The Tor Project maintains its own Debian/Raspberry Pi OS repository, which provides newer versions than the standard apt archive:

# Add the Tor Project's official repository
pi@raspberrypi:~$ sudo apt install -y apt-transport-https gnupg

pi@raspberrypi:~$ curl -fsSL https://deb.torproject.org/torproject.org/A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc | \
  sudo gpg --dearmor -o /usr/share/keyrings/tor-archive-keyring.gpg

pi@raspberrypi:~$ echo "deb [arch=arm64 signed-by=/usr/share/keyrings/tor-archive-keyring.gpg] https://deb.torproject.org/torproject.org bookworm main" | \
  sudo tee /etc/apt/sources.list.d/tor.list

pi@raspberrypi:~$ sudo apt update
pi@raspberrypi:~$ sudo apt install -y tor deb.torproject.org-keyring

pi@raspberrypi:~$ sudo systemctl status tor
● tor.service - Anonymizing overlay network for TCP
     Active: active (running)

Step 2 — Configure Your Relay

All relay configuration lives in /etc/tor/torrc. Back up the original first, then replace it with a clean relay config:

pi@raspberrypi:~$ sudo cp /etc/tor/torrc /etc/tor/torrc.bak
pi@raspberrypi:~$ sudo nano /etc/tor/torrc

Replace (or add) the following settings — read each comment before setting your values:

# ── Relay identity ─────────────────────────────────────────────────
Nickname          MyPiRelay         # public name for your relay (letters/digits only, max 19 chars)
ContactInfo       your_email_AT_example.com  # obfuscate to reduce spam

# ── Ports ──────────────────────────────────────────────────────────
ORPort            9001             # the port other relays connect to — must be forwarded in your router
DirPort           0                # set to 9030 to serve directory info (optional, helps the network)

# ── Exit policy — IMPORTANT ────────────────────────────────────────
ExitPolicy        reject *:*        # refuse ALL exit traffic — makes this a middle relay only

# ── Bandwidth limits ───────────────────────────────────────────────
RelayBandwidthRate  1 MB            # sustained rate (1 MB/s = ~2.6 TB/month)
RelayBandwidthBurst 2 MB            # peak burst rate

# ── Optional: limit total monthly bandwidth ────────────────────────
# AccountingMax    500 GB           # stop accepting circuits after 500 GB
# AccountingStart  month 1 00:00    # reset counter on the 1st of each month

# ── Logging ────────────────────────────────────────────────────────
Log               notice file /var/log/tor/notices.log

# ── Data directory ─────────────────────────────────────────────────
DataDirectory     /var/lib/tor

Choose your bandwidth limits sensibly

Step 3 — Open the Firewall and Forward the Port

# Allow Tor's ORPort through ufw (if you're using ufw)
pi@raspberrypi:~$ sudo ufw allow 9001/tcp
pi@raspberrypi:~$ sudo ufw reload

In your router's admin panel, add a port forwarding rule:

• External port: 9001 (TCP)
• Internal IP: your Pi's local IP address
• Internal port: 9001

Verify the port is reachable from outside your network using canyouseeme.org or a similar tool.

Step 4 — Start and Verify Your Relay

pi@raspberrypi:~$ sudo systemctl restart tor
pi@raspberrypi:~$ sudo tail -f /var/log/tor/notices.log
Nov 01 10:14:22.000 [notice] Tor has successfully opened a circuit.
Nov 01 10:14:23.000 [notice] Bootstrapped 100% (done): Done
Nov 01 10:14:45.000 [notice] Self-testing indicates your ORPort is reachable from the outside. Excellent.

The critical line is "Self-testing indicates your ORPort is reachable". If you see this, your relay is correctly set up and is now connecting to the Tor network.

Step 5 — Monitor Your Relay with Nyx

Nyx is a terminal-based dashboard for Tor relays — it shows real-time bandwidth, circuit counts, connection details, and log output in a polished interface.

pi@raspberrypi:~$ sudo apt install -y nyx

Allow your user to connect to Tor's control port:

pi@raspberrypi:~$ sudo nano /etc/tor/torrc

Add at the end:

# ── Control port for nyx ───────────────────────────────────────────
ControlPort       9051
CookieAuthentication 1
CookieAuthFileGroupReadable 1
DataDirectoryGroupReadable 1

pi@raspberrypi:~$ sudo usermod -aG debian-tor $USER
pi@raspberrypi:~$ sudo systemctl restart tor
pi@raspberrypi:~$ nyx

Press m for the menu, ←/→ to navigate pages (bandwidth graph, connection list, configuration), q to quit.

Step 6 — Find Your Relay on Metrics.Torproject.org

Once your relay has been running for about 24 hours and has been included in the consensus, it will appear on the Tor Project's public relay search:

• Go to metrics.torproject.org/rs.html
• Search for your relay's Nickname or fingerprint
• You'll see bandwidth history, uptime, flags (Stable, Fast, Guard), and your position in the Tor network
• Share the link — running a relay is worth being proud of

Your relay earns flags from the directory authorities as it proves itself:

Step 7 — Set Up Monthly Bandwidth Accounting (Optional)

If your broadband plan has a monthly data cap, use Tor's accounting feature to automatically pause the relay once it reaches a limit:

pi@raspberrypi:~$ sudo nano /etc/tor/torrc

# Pause relay after 300 GB in each calendar month
AccountingMax    300 GB
AccountingStart  month 1 00:00   # reset on 1st of each month

pi@raspberrypi:~$ sudo systemctl restart tor

# Check accounting status at any time:
pi@raspberrypi:~$ sudo -u debian-tor tor --quiet --hush -f /etc/tor/torrc --Accounting
# or via nyx → press 'c' for the configuration page

You can also split the accounting symmetrically so both upload and download are counted equally:

AccountingMax    300 GB
AccountingRule   sum    # count upload + download combined (default)
# AccountingRule max    # count whichever direction is higher

Troubleshooting

Quick Reference