Setting up a Tor Middle/Guard Relay on Debian or Ubuntu

Introduction

This tutorial installs a non-exit Tor relay on an existing Debian or Ubuntu server. It forwards encrypted traffic within the Tor network. It does not act as an exit to public websites.

This setup was tested on a Hetzner Cloud CX33, running Ubuntu Server 26.04 LTS. The Tor network decides whether the relay later qualifies as a Guard.

Prerequisites

• A supported Debian or Ubuntu release on amd64 or arm64.
• Root access or a user with sudo privileges.
• A public IPv4 address and optionally working IPv6.
• At least 10 Mbit/s upload and download bandwidth (this should be no issue on a Hetzner server)
• Enough monthly traffic for the bandwidth you donate.

Step 1 - Install Tor

Use the Tor Project repository to receive current stable packages. Your release codename must be supported by that repository.

sudo apt update
sudo apt install ca-certificates curl gnupg

curl -fsSL https://deb.torproject.org/torproject.org/A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc \
  | gpg --dearmor \
  | sudo tee /usr/share/keyrings/deb.torproject.org-keyring.gpg >/dev/null
sudo chmod 644 /usr/share/keyrings/deb.torproject.org-keyring.gpg

. /etc/os-release
cat <<EOF | sudo tee /etc/apt/sources.list.d/tor.sources >/dev/null
Types: deb
URIs: https://deb.torproject.org/torproject.org/
Suites: ${VERSION_CODENAME}
Components: main
Signed-By: /usr/share/keyrings/deb.torproject.org-keyring.gpg
EOF

sudo apt update
sudo apt install tor tor-geoipdb deb.torproject.org-keyring
tor --version

If APT reports an error, resolve it before continuing. Use a supported stable Tor release.

Step 2 - Configure the relay

Back up /etc/tor/torrc, then open it with your preferred editor:

sudo cp -a /etc/tor/torrc /etc/tor/torrc.before-relay
sudo nano /etc/tor/torrc

Replace its contents with:

Nickname myNiceRelay
ContactInfo holu@example.com

ORPort 9001 IPv4Only

ExitRelay 0
SocksPort 0

RelayBandwidthRate 5 MBytes
RelayBandwidthBurst 10 MBytes

ControlPort 127.0.0.1:9051
CookieAuthentication 1

Log notice stdout

Change the nickname and contact address. Both will be public. Nicknames may contain 1–19 letters and numbers.

ExitRelay 0 disables exit operation. SocksPort 0 disables the local proxy. The control port is available only on localhost, for monitoring.

The bandwidth rate applies in each direction. 5 MBytes means 5 MiB/s, approximately 42 Mbit/s. It could use around 13.6 TB of outgoing traffic over 30 days at continuous full speed. Adjust it to your traffic allowance; the burst setting is a bucket size, not a monthly limit.

Optional IPv6

Tor normally discovers your public IPv4 address. To also advertise IPv6, add a second ORPort line using an address assigned to your server:

ORPort [YOUR_PUBLIC_IPV6]:9001

E.g. ORPort [2001:db8:5678::1]:9001

Keep the IPv4 line. Only add IPv6 if it works and is reachable: a failed explicit IPv6 reachability check can prevent descriptor publication.

Step 3 - Allow the relay port

In your existing Hetzner Cloud Firewall, allow inbound TCP 9001 from ANY IPv4 and, if using IPv6, ANY IPv6. Keep your SSH access rule and allow outbound traffic. Do not expose TCP 9051.

If a local firewall is active, allow the port there too. For UFW:

sudo ufw allow 9001/tcp

Step 4 - Start and verify Tor

Validate the configuration, then start the service:

sudo tor \
  --defaults-torrc /usr/share/tor/tor-service-defaults-torrc \
  -f /etc/tor/torrc \
  --verify-config

sudo systemctl enable tor@default.service
sudo systemctl restart tor@default.service
sudo systemctl status tor@default.service --no-pager
sudo journalctl -u tor@default.service -n 100 -f

Only restart after validation succeeds. Look for completed bootstrap, successful ORPort reachability checks and descriptor publication. Bootstrap alone does not confirm inbound reachability. Press Ctrl+C to leave the logs.

Read your public relay fingerprint:

sudo cat /var/lib/tor/fingerprint

Search for it on Tor Relay Search. Allow a few hours for the relay to appear. Check its addresses, running status and that it has no Exit flag. Low traffic is normal for a new relay.

Step 5 - Optional Nyx monitoring

sudo apt install nyx
sudo -H -u debian-tor nyx

Nyx connects to the local control port and shows bandwidth, connections and logs. Press h for help or q to quit. Tor keeps running.

Step 6 - Maintenance and relay families

Keep Tor and the operating system updated:

sudo apt update
sudo apt upgrade

Check uptime and traffic regularly. Preserve /var/lib/tor/keys: these files contain the relay identity and belong in a secure backup.

If you run multiple relays, configure a shared FamilyId using the official family-key guide. All members need the same secret family key and matching FamilyId configuration.

Older migration instructions also used reciprocal MyFamily fingerprint lists. Tor's current post-install guidance marks this previous method as removed. Use FamilyId for a new setup.

Conclusion

Your server now runs a non-exit Tor relay. Keep it online, updated and within your traffic allowance. Guard selection happens automatically if the relay qualifies.

Official links:

• Tor relay setup for Debian/Ubuntu
• Tor relay requirements
• Tor automatic updates
• Hetzner Cloud Firewall documentation

License: MIT