_model: page
---
color: primary
---
title: Debian / Ubuntu
---
body:

### 1. Install Tor

Get the latest version of Tor. If you're on Debian stable, `sudo apt-get install tor` should give you the latest stable version of Tor.

* Note: **Ubuntu users need to get it from Tor repository. Please see** [Download instructions for Ubuntu](https://support.torproject.org/apt/tor-deb-repo/).

### 2. Install obfs4proxy

On [Debian](https://packages.debian.org/search?keywords=obfs4proxy), the `obfs4proxy` package is available in unstable, testing, and stable.
On [Ubuntu](https://packages.ubuntu.com/search?keywords=obfs4proxy), bionic, cosmic, disco, and eoan have the package.
If you're running any of them, `sudo apt-get install obfs4proxy` should work.

If not, you can [build it from source](https://gitlab.com/yawning/obfs4#installation).

### 3. Edit your Tor config file, usually located at `/etc/tor/torrc` and replace its content with:

```
BridgeRelay 1

# Replace "TODO1" with a Tor port of your choice.
# This port must be externally reachable.
# Avoid port 9001 because it's commonly associated with Tor and censors may be scanning the Internet for this port.
ORPort TODO1

ServerTransportPlugin obfs4 exec /usr/bin/obfs4proxy

# Replace "TODO2" with an obfs4 port of your choice.
# This port must be externally reachable and must be different from the one specified for ORPort.
# Avoid port 9001 because it's commonly associated with Tor and censors may be scanning the Internet for this port.
ServerTransportListenAddr obfs4 0.0.0.0:TODO2

# Local communication port between Tor and obfs4.  Always set this to "auto".
# "Ext" means "extended", not "external".  Don't try to set a specific port number, nor listen on 0.0.0.0.
ExtORPort auto

# Replace "<address@email.com>" with your email address so we can contact you if there are problems with your bridge.
# This is optional but encouraged.
ContactInfo <address@email.com>

# Pick a nickname that you like for your bridge.  This is optional.
Nickname PickANickname
```

Don't forget to change the `ORPort`, `ServerTransportListenAddr`, `ContactInfo`, and `Nickname` options.

* If you decide to use a fixed obfs4 port smaller than 1024 (for example 80 or 443), you will need to give obfs4 `CAP_NET_BIND_SERVICE` capabilities to bind the port with a non-root user:

  `sudo setcap cap_net_bind_service=+ep /usr/bin/obfs4proxy`

* Note that both Tor's OR port and its obfs4 port must be reachable.
  If your bridge is behind a firewall or NAT, make sure to open both ports.
  You can use [our reachability test](https://bridges.torproject.org/scan/) to see if your obfs4 port is reachable from the Internet.

You will also need to set `NoNewPrivileges=no` in `/lib/systemd/system/tor@default.service` and `/lib/systemd/system/tor@.service` and then run `systemctl daemon-reload`. (see [bug #18356](https://trac.torproject.org/projects/tor/ticket/18356))

### 4. Restart tor

`systemctl restart tor`

### 5. Monitor your logs

To confirm your bridge is running with no issues, you should see something like this (usually in `/var/log/tor/log` or `/var/log/syslog`):


```
[notice] Your Tor server's identity key fingerprint is '<NICKNAME> <FINGERPRINT>'
[notice] Your Tor bridge's hashed identity key fingerprint is '<NICKNAME> <HASHED FINGERPRINT>'
[notice] Registered server transport 'obfs4' at '[::]:46396'
[notice] Tor has successfully opened a circuit. Looks like client functionality is working.
[notice] Bootstrapped 100%: Done
[notice] Now checking whether ORPort <redacted>:3818 is reachable... (this may take up to 20 minutes -- look for log messages indicating success)
[notice] Self-testing indicates your ORPort is reachable from the outside. Excellent. Publishing server descriptor.
```

### 6. Final notes

If you are having troubles setting up your bridge, have a look at [our help
section](https://community.torproject.org/relay/getting-help/). If
your bridge is now running, check out the [post-install
notes](https://community.torproject.org/relay/setup/bridge/post-install/).

---
key: 1
---
html: two-columns-page.html
---
subtitle: How to deploy an obfs4 bridge on Debian / Ubuntu
