The Tor network runs on relays operated by volunteers, and a VPS is one of the easiest places to run one: always on, a static IP, and more bandwidth than a home line. Before choosing a host or writing a torrc, decide which kind of relay you want. That choice determines what traffic leaves your server, who gets the complaints, and whether your provider allows it at all.
Middle, guard, bridge, exit — what each means for you
- Middle relay. Passes encrypted traffic between other relays. It never connects to websites on anyone’s behalf, so abuse reports about your IP are rare. It is the default recommendation for a first relay.
- Guard relay. A middle relay that has proven fast and stable. The network gives it the Guard flag automatically after it has been up for a while, and it becomes the first hop for clients. You do not configure it; you earn it with uptime.
- Bridge. An unlisted entry point for people in countries that block Tor. Modest bandwidth is fine, and it is not in the public relay list.
- Exit relay. The last hop. Connections to websites come from your IP, so abuse complaints, copyright notices and law-enforcement enquiries go to you and your host. Exits are what most providers mean when they say “no Tor”, and running one takes preparation beyond a config line.
Check your host’s rules first
Read the acceptable use policy and, when in doubt, ask before you deploy. Being switched off halfway through the ramp-up helps nobody. For VMHeaven specifically:
- Standard KVM and Hi-CPU KVM run on our clean IP range. Exit relays are not allowed there. Middle relays and bridges are the kind of relay to run on these lines. Open a short ticket before you start, so support can confirm your plan’s fair-use traffic fits the bandwidth you intend to donate.
- DMCA Ignored KVM is the only line where an exit could fit at all, and only if it is compatible with the Acceptable Use Policy. Talk to support before you set
ExitRelay 1. They will tell you whether it is possible and on what terms. “DMCA ignored” covers copyright notices, not the reports about scanning, spam or attacks that every exit also receives. - Not sure? Run a middle relay. It is the most useful thing most operators can give the network, and it causes no trouble for anyone.
What a relay needs
- Bandwidth: the Tor Project asks for at least 16 Mbit/s in each direction, and at least 100 GB of traffic per month each way. More helps — several TB a month is typical for a good middle relay.
- Memory: 512 MB is enough below about 40 Mbit/s. Give faster relays at least 1 GB, and exits more.
- CPU: tor does most of its work on one core, so clock speed matters more than core count. AES-NI, which every current server CPU has, is a must.
- Uptime and a static IP. Relays that come and go get little traffic and never earn the Guard flag.
- Network diversity. A few large hosting networks already carry a large share of all relays. A relay on a less crowded network adds more to the network’s resilience than yet another one on the same few.
Install tor
Relays should run a current stable release. The directory authorities eventually reject versions that are no longer supported. The Tor Project’s own repository always has the latest one:
sudo apt install -y gpg wget
wget -qO- https://deb.torproject.org/torproject.org/A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc \
| gpg --dearmor | sudo tee /usr/share/keyrings/deb.torproject.org-keyring.gpg >/dev/null
echo "deb [signed-by=/usr/share/keyrings/deb.torproject.org-keyring.gpg] https://deb.torproject.org/torproject.org $(. /etc/os-release && echo "$VERSION_CODENAME") main" \
| sudo tee /etc/apt/sources.list.d/tor.list
sudo apt update
sudo apt install -y tor deb.torproject.org-keyring# Rocky, AlmaLinux (tor comes from EPEL)
sudo dnf install -y epel-release && sudo dnf install -y tor
# Fedora
sudo dnf install -y torTurn on automatic updates (unattended-upgrades on Debian and Ubuntu) and make sure they include the Tor Project origin. A relay nobody patches is a liability.
Configure a middle relay
Replace the contents of /etc/tor/torrc with a minimal relay configuration:
Nickname myVpsRelay01
ContactInfo [email protected]
ORPort 443
ExitRelay 0
SocksPort 0
# optional: keep tor inside your traffic allowance
RelayBandwidthRate 20 MBytes # sustained, about 160 Mbit/s
RelayBandwidthBurst 40 MBytes- Nickname: 1–19 letters and digits, no spaces.
- ContactInfo: this is published. Use an address you are happy to have public, and that you read — the Tor Project uses it to contact operators about problems.
- ORPort 443 helps clients behind strict firewalls. If a web server already uses 443 on the machine, use
9001instead. - ExitRelay 0 is the line that makes this a non-exit. Keep it explicit.
Capping monthly traffic
A rate limit spreads your bandwidth evenly and keeps the relay useful all month. It is the better tool. If you need a hard monthly cap, tor can hibernate once a quota is used up. By default the limit applies to each direction separately:
AccountingMax 4 TBytes
AccountingStart month 1 00:00A relay that hibernates halfway through every month is a poor guard, so prefer RelayBandwidthRate where you can.
Start it and check it is reachable
sudo ufw allow 443/tcp # or 9001/tcp
sudo systemctl enable --now tor
sudo systemctl restart tor
sudo journalctl -u tor@default -f # Debian/Ubuntu; plain 'tor' on RHEL/FedoraWithin a few minutes the log should show a line like this:
Self-testing indicates your ORPort … is reachable from the outside. Excellent.If it never appears, the port is blocked. Check the server firewall and any firewall your provider runs in front of it.
If the server has a global IPv6 address, current tor versions test and publish that too. A relay reachable on both address families is more useful. Your relay’s fingerprint is in /var/lib/tor/fingerprint. Search for it or the nickname on Tor Relay Search after a few hours.
Expect little traffic at first. New relays are measured before they get real load, it takes days to ramp up, and the Guard flag comes after a week or more of stable uptime. That is normal and says nothing about your setup. For a live view on the server, install nyx.
Running more than one relay? List them in each other’s MyFamily line, so that clients never use two of your relays in the same circuit.
Running a bridge instead
A bridge with the obfs4 transport helps users whose networks block Tor, and it stays out of the public relay list:
sudo apt install -y obfs4proxyBridgeRelay 1
ORPort 9001
ServerTransportPlugin obfs4 exec /usr/bin/obfs4proxy
ServerTransportListenAddr obfs4 0.0.0.0:8443
ExtORPort auto
ContactInfo [email protected]
Nickname myVpsBridge01Open both 9001/tcp and 8443/tcp. The Tor Project’s bridge guide covers the finer points, such as keeping the obfs4 port stable.
If you are permitted to run an exit
Only with your host’s explicit, prior permission. At VMHeaven that means the DMCA Ignored line and a conversation with support first. Then do it the way experienced exit operators do:
- A dedicated IP used for nothing else, with reverse DNS that says it is a Tor exit.
- A contact address that answers abuse reports quickly, plus a short standard reply explaining what an exit relay is.
- An exit notice page on port 80, so anyone who looks up the IP learns what it is.
- Your own caching DNS resolver on the server, rather than a public one.
- A restrictive exit policy. Loosen it later if complaints stay manageable.
ExitRelay 1
IPv6Exit 1
# web traffic only — the fewest complaints
ExitPolicy accept *:80
ExitPolicy accept *:443
ExitPolicy reject *:*Tor also ships a broader, curated option, ReducedExitPolicy 1, that allows more common ports while still blocking the ones behind most abuse. Never run an exit from a home connection or from a host that has not agreed to it.
Checklist
- Relay type chosen — middle unless you have a reason and permission for more.
- Host’s policy checked; support asked when unsure.
- Current tor from the Tor Project repository, with automatic updates.
- Real ContactInfo,
ExitRelay 0, bandwidth capped to your allowance. - ORPort reachable over IPv4 and, ideally, IPv6.
If you are paying for the server privately as well, see paying for a VPS with crypto. For the wider picture of what a VPS can and cannot hide, read anonymous VPS hosting.
Frequently asked
Is it risky to run a Tor middle relay on a VPS?
Low risk. A middle relay only talks to other relays, so it rarely draws abuse reports. Its IP is listed publicly, though, and some services block all relay IPs — keep it off addresses you need for mail or logins.
Can I run a Tor exit relay on VMHeaven?
Not on Standard KVM or Hi-CPU KVM, which use a clean IP range. DMCA Ignored KVM is the only line where an exit could fit, and only if the AUP permits it — ask support before configuring one.
How much bandwidth does a Tor relay need?
The Tor Project asks for at least 16 Mbit/s each way and 100 GB of traffic per month in each direction. Use RelayBandwidthRate to keep the relay within your plan's allowance.