Running a Tor relay on a VPS: a practical guide
How to run a Tor relay — why relays matter, hardware and bandwidth needs, the exact install, the limits that keep you useful but not a liability, and how to verify it works.
Most people use Tor and few run it. Relays are what keep the network usable, and running one is genuinely easy — a package install and a config line. The important parts are the limits that keep you a useful relay rather than a liability, which this guide covers in full.
What a relay does and does not do
A guard, middle or exit relay each plays a different role. The key thing to understand first: a relay is not anonymous by default and is not private — if you run one, know what you are publishing.
- ▹Guard — the first hop for users. Highest sensitivity, most likely to be targeted.
- ▹Middle — pure relay, sees encrypted traffic only, the easiest and safest role.
- ▹Exit — where traffic leaves to the open internet. Exits see plaintext and receive abuse complaints, so they need care.
Note · If you want to help without any exposure, run a middle relay. That is the default role, it is what the network mostly needs, and it carries none of the legal risk of an exit.
What you need
Relays are I/O-bound, not CPU-bound, which is why the cheapest tier works. The traffic is encrypted end to end, so a middle relay does not meaningfully increase your disk or CPU load.
| Minimum | Recommended | |
|---|---|---|
| Plan | Wisp $6 | Pulse $10+ |
| Bandwidth | 1 Mbps | Unmetered, all tiers |
| Disk | 5 GB | 20 GB is plenty |
| RAM | 1 GB | 2 GB for headroom |
| Time | A few minutes | Same |
Install it
Debian and Ubuntu have the package in the main repository, so this is genuinely one command.
- 01.apt update && apt install tor deb.torproject.org-keyring — install the package.
- 02.Edit /etc/tor/torrc; the defaults are close to correct.
- 03.Set SocksPort 0 to run relay-only, and set your ContactInfo.
- 04.systemctl restart tor, then systemctl enable tor so it survives reboots.
The single most useful setting for a first-time operator is SocksPort 0. It disables the SOCKS proxy so your server cannot be used as an open proxy — an accidental abuse magnet — while still relaying for other users.
Set the right limits
Unlimited relays are what get relays blocked. Set them deliberately.
- ▹MaxAdvertisedBandwidth — cap it to what you can afford, so a busy night does not become your whole month.
- ▹DirPort — set to 0 unless you intend to run a directory cache.
- ▹ORPort 9001, if your provider allows the port, improves your usefulness as an exit.
- ▹ContactInfo — a working email is how the Tor project reaches you about problems.
If you must run an exit
Exits see plaintext traffic and get abuse reports — copyright, phishing, scanning. If you run one, it needs a published policy page describing what you do, a reasonably fast connection, and the willingness to handle complaints. Most first-time operators should not run an exit.
Verify it is working
Check the logs for a Bootstrapped 100% line, then look yourself up on a relay directory. If your relay appears as Running, it is part of the network. There is also a monitoring dashboard pattern worth copying for uptime checks.
FAQ
QIs running a Tor relay illegal?
AIn most jurisdictions, no — running a relay is legal. The legal exposure is as an exit, where you forward other people's traffic. This is general information, not legal advice.
QWill my VPS provider complain?
AUnlikely if you do not run an exit with no limits. Providers tolerate relays; what draws complaints is an open proxy or an unlimited exit.
QDoes a relay slow down my other services?
AMarginally at most. Relays are I/O-bound and the traffic is encrypted, so on the cheap tiers the impact is small.
QShould I run a guard or exit?
ANeither, unless you know what you are taking on. A middle relay is the most useful and least risky role for a first relay.