Tor - Revision history

Mh: Add obfs4 config for running a tor bridge

2026-08-03T14:33:53Z

Add obfs4 config for running a tor bridge

← Older revision		Revision as of 14:33, 3 August 2026
Line 75:		Line 75:
	Nickname = "YourNickname";		Nickname = "YourNickname";
	ContactInfo = "your-email@example.com";		ContactInfo = "your-email@example.com";

			# obfs4 proxy, use when running a bridge. Change port as needed
			ServerTransportListenAddr = [ "obfs4 0.0.0.0:8443" ];

	# Bandwidth settings		# Bandwidth settings

DHCP: style fixes

2026-07-19T17:24:01Z

style fixes

← Older revision		Revision as of 17:24, 19 July 2026
Line 12:		Line 12:

	==== Using nix-shell ====		==== Using nix-shell ====
	<syntaxhighlight lang=~~"bash" start="3"~~>		<syntaxhighlight lang=console>
	nix-shell -p tor-browser		$ nix-shell -p tor-browser
	</syntaxhighlight>		</syntaxhighlight>

	==== Using Global Configuration ====		==== Using Global Configuration ====
	<syntaxhighlight lang=~~"text"~~>		<syntaxhighlight lang=nix>
	environment.systemPackages = [		environment.systemPackages = [
	pkgs.tor-browser		pkgs.tor-browser
	];		];
	</syntaxhighlight>After modifying your configuration, apply the changes by running:<syntaxhighlight lang=~~"bash"~~>		</syntaxhighlight>
	~~sudo~~ nixos-rebuild switch		After modifying your configuration, apply the changes by running:
			<syntaxhighlight lang=console>
			# nixos-rebuild switch
	</syntaxhighlight>		</syntaxhighlight>

	==== Using Home Configuration ====		==== Using Home Configuration ====
	<syntaxhighlight lang=~~"text"~~>		<syntaxhighlight lang=nix>
	home.packages = [		home.packages = [
	pkgs.tor-browser		pkgs.tor-browser
	];		];
	</syntaxhighlight>After updating your configuration, apply the changes by running:<syntaxhighlight lang=~~"bash"~~>		</syntaxhighlight>
	home-manager switch		After updating your configuration, apply the changes by running:
			<syntaxhighlight lang=console>
			$ home-manager switch
	</syntaxhighlight>		</syntaxhighlight>

Line 138:		Line 142:
	Tor can be enabled as a system service by enabling options {{nixos:option\|services.tor.enable}}. Configuration of tor service is an example of [https://nixos.org/manual/nixos/stable/index.html#sec-freeform-modules Freeform module], so you can pass not only explicitly supported {{nixos:option\|services.tor.settings}}, but all other [https://2019.www.torproject.org/docs/tor-manual.html.en torrc] options. For example, a client obfs4 bridge config can be set like this:		Tor can be enabled as a system service by enabling options {{nixos:option\|services.tor.enable}}. Configuration of tor service is an example of [https://nixos.org/manual/nixos/stable/index.html#sec-freeform-modules Freeform module], so you can pass not only explicitly supported {{nixos:option\|services.tor.settings}}, but all other [https://2019.www.torproject.org/docs/tor-manual.html.en torrc] options. For example, a client obfs4 bridge config can be set like this:

	<syntaxhighlight lang="nix">services.tor.settings = {		<syntaxhighlight lang="nix">
	UseBridges = true;		services.tor.settings = {
	ClientTransportPlugin = "obfs4 exec ${pkgs.obfs4}/bin/lyrebird";		UseBridges = true;
	Bridge = "obfs4 IP:ORPort [fingerprint]";		ClientTransportPlugin = "obfs4 exec ${pkgs.obfs4}/bin/lyrebird";
	};</syntaxhighlight>For a webtunnel bridge, use:<syntaxhighlight lang="nix">services.tor.settings = {		Bridge = "obfs4 IP:ORPort [fingerprint]";
	UseBridges = true;		};
	ClientTransportPlugin = "webtunnel exec ${pkgs.webtunnel}/bin/client";		</syntaxhighlight>
	Bridge = "webtunnel IP:ORPort [fingerprint]";		For a webtunnel bridge, use:
	};</syntaxhighlight>		<syntaxhighlight lang="nix">
			services.tor.settings = {
			UseBridges = true;
			ClientTransportPlugin = "webtunnel exec ${pkgs.webtunnel}/bin/client";
			Bridge = "webtunnel IP:ORPort [fingerprint]";
			};
			</syntaxhighlight>

	By default, Tor in NixOS provides one SOCKS proxy on port 9050. Port 9050 is a "slow" SOCKS port which can be used for email, git, and pretty much any other protocol except HTTP(S). This is a safe default which complicates identity correlation attacks, although it isn't sufficient to completely thwart them.		By default, Tor in NixOS provides one SOCKS proxy on port 9050. Port 9050 is a "slow" SOCKS port which can be used for email, git, and pretty much any other protocol except HTTP(S). This is a safe default which complicates identity correlation attacks, although it isn't sufficient to completely thwart them.

Bonafide14: Added a template for configuring a webtunnel bridge. It would've saved me some time a week ago.

2026-06-24T19:33:49Z

Added a template for configuring a webtunnel bridge. It would've saved me some time a week ago.

← Older revision		Revision as of 19:33, 24 June 2026
Line 136:		Line 136:
	{{Security Warning\|Do not attempt to use Tor with any web browsers other than Tor Browser. Tor Browser integrates custom modifications to Firefox to enhance anonymity and ensure that information leakage does not occur. Using another web browser with Tor is likely to result in imperfect anonymity and is unsafe.}}		{{Security Warning\|Do not attempt to use Tor with any web browsers other than Tor Browser. Tor Browser integrates custom modifications to Firefox to enhance anonymity and ensure that information leakage does not occur. Using another web browser with Tor is likely to result in imperfect anonymity and is unsafe.}}

	Tor can be enabled as a system service by enabling options {{nixos:option\|services.tor.enable}}. Configuration of tor service is an example of [https://nixos.org/manual/nixos/stable/index.html#sec-freeform-modules Freeform module], so you can pass not only explicitly supported {{nixos:option\|services.tor.settings}}, but all other [https://2019.www.torproject.org/docs/tor-manual.html.en torrc] options. For example, client bridge config can be set like this:		Tor can be enabled as a system service by enabling options {{nixos:option\|services.tor.enable}}. Configuration of tor service is an example of [https://nixos.org/manual/nixos/stable/index.html#sec-freeform-modules Freeform module], so you can pass not only explicitly supported {{nixos:option\|services.tor.settings}}, but all other [https://2019.www.torproject.org/docs/tor-manual.html.en torrc] options. For example, a client obfs4 bridge config can be set like this:

	<syntaxhighlight lang="nix">		<syntaxhighlight lang="nix">services.tor.settings = {
	services.tor.settings = {
	UseBridges = true;		UseBridges = true;
	ClientTransportPlugin = "obfs4 exec ${pkgs.obfs4}/bin/lyrebird";		ClientTransportPlugin = "obfs4 exec ${pkgs.obfs4}/bin/lyrebird";
	Bridge = "obfs4 IP:ORPort [fingerprint]";		Bridge = "obfs4 IP:ORPort [fingerprint]";
	};		};</syntaxhighlight>For a webtunnel bridge, use:<syntaxhighlight lang="nix">services.tor.settings = {
	</syntaxhighlight>		UseBridges = true;
			ClientTransportPlugin = "webtunnel exec ${pkgs.webtunnel}/bin/client";
			Bridge = "webtunnel IP:ORPort [fingerprint]";
			};</syntaxhighlight>

	By default, Tor in NixOS provides one SOCKS proxy on port 9050. Port 9050 is a "slow" SOCKS port which can be used for email, git, and pretty much any other protocol except HTTP(S). This is a safe default which complicates identity correlation attacks, although it isn't sufficient to completely thwart them.		By default, Tor in NixOS provides one SOCKS proxy on port 9050. Port 9050 is a "slow" SOCKS port which can be used for email, git, and pretty much any other protocol except HTTP(S). This is a safe default which complicates identity correlation attacks, although it isn't sufficient to completely thwart them.

Infgotoinf: Add a missing semicolon

2026-04-18T20:07:12Z

Add a missing semicolon

← Older revision		Revision as of 20:07, 18 April 2026
Line 142:		Line 142:
	UseBridges = true;		UseBridges = true;
	ClientTransportPlugin = "obfs4 exec ${pkgs.obfs4}/bin/lyrebird";		ClientTransportPlugin = "obfs4 exec ${pkgs.obfs4}/bin/lyrebird";
	Bridge = "obfs4 IP:ORPort [fingerprint]"		Bridge = "obfs4 IP:ORPort [fingerprint]";
	};		};
	</syntaxhighlight>		</syntaxhighlight>

SigmaSquadron: Switch custom HTML warnings with Template:Security Warning

2025-04-17T18:00:35Z

Switch custom HTML warnings with Template:Security Warning

← Older revision		Revision as of 18:00, 17 April 2025
Line 1:		Line 1:
	~~<div style="border: 1px solid #D33; background: #FFEBEB; padding: 30px; border-radius: 5px; margin: 10px 0px; display: flex; align-items: center;">~~		{{Security Warning\|To achieve effective anonymity with Tor, you must understand its <strong>caveats</strong> and adjust your <strong>browsing habits</strong>. The Tor Project provides a crucial [https://support.torproject.org/faq/staying-anonymous/ list of tips] that you should read before using Tor.\|heading=Tor is not a panacea.}}
	~~<div style="color: #D33; font-size: 40px; margin-right: 15px; background: #FFEBEB; display: flex; line-height: 0; align-items: center;">⚠</div>~~
	~~<div style="color: #D33; font-size: 15px; font-style: normal; font-weight: 400; line-height: normal; text-align: left;"><strong>Tor is not a panacea.</strong>~~ To achieve effective anonymity with Tor, you must understand its <strong>caveats</strong> and adjust your <strong>browsing habits</strong>. The Tor Project provides a crucial [https://support.torproject.org/faq/staying-anonymous/ list of tips] that you should read before using Tor.~~</div>~~
	~~</div>~~

	<strong>Tor (The Onion Router)</strong> is a free, open-source software that enables anonymous internet communication. It protects users' privacy by routing traffic through a global network of volunteer-operated servers, masking IP addresses and online activities. Tor's key features include <strong>anonymity</strong>, <strong>privacy</strong>, and <strong>censorship circumvention</strong>. It supports hidden services with <strong>.onion domains</strong> for additional anonymity.		<strong>Tor (The Onion Router)</strong> is a free, open-source software that enables anonymous internet communication. It protects users' privacy by routing traffic through a global network of volunteer-operated servers, masking IP addresses and online activities. Tor's key features include <strong>anonymity</strong>, <strong>privacy</strong>, and <strong>censorship circumvention</strong>. It supports hidden services with <strong>.onion domains</strong> for additional anonymity.
Line 137:		Line 134:

	=== Client Bridge ===		=== Client Bridge ===
	~~<div style="border: 1px solid #D33; background: #FFEBEB; padding: 30px; border-radius: 5px; margin: 10px 0px; display: flex; align-items: center;">~~		{{Security Warning\|Do not attempt to use Tor with any web browsers other than Tor Browser. Tor Browser integrates custom modifications to Firefox to enhance anonymity and ensure that information leakage does not occur. Using another web browser with Tor is likely to result in imperfect anonymity and is unsafe.}}
	~~<div style="color: #D33; font-size: 40px; margin-right: 15px; background: #FFEBEB; display: flex; line-height: 0; align-items: center;">⚠</div>~~
	~~<div style="color: #D33; font-size: 15px; font-style: normal; font-weight: 400; line-height: normal; text-align: left;">~~Do not attempt to use Tor with any web browsers other than Tor Browser. Tor Browser integrates custom modifications to Firefox to enhance anonymity and ensure that information leakage does not occur. Using another web browser with Tor is likely to result in imperfect anonymity and is unsafe.~~</div>~~
	~~</div>~~

	Tor can be enabled as a system service by enabling options {{nixos:option\|services.tor.enable}}. Configuration of tor service is an example of [https://nixos.org/manual/nixos/stable/index.html#sec-freeform-modules Freeform module], so you can pass not only explicitly supported {{nixos:option\|services.tor.settings}}, but all other [https://2019.www.torproject.org/docs/tor-manual.html.en torrc] options. For example, client bridge config can be set like this:		Tor can be enabled as a system service by enabling options {{nixos:option\|services.tor.enable}}. Configuration of tor service is an example of [https://nixos.org/manual/nixos/stable/index.html#sec-freeform-modules Freeform module], so you can pass not only explicitly supported {{nixos:option\|services.tor.settings}}, but all other [https://2019.www.torproject.org/docs/tor-manual.html.en torrc] options. For example, client bridge config can be set like this:

Phanirithvij: /* References */

2025-03-15T07:19:00Z

References

← Older revision		Revision as of 07:19, 15 March 2025
Line 212:		Line 212:
	# https://2019.www.torproject.org/docs/tor-manual.html.en		# https://2019.www.torproject.org/docs/tor-manual.html.en
	# https://wiki.archlinux.org/title/Tor#TorDNS		# https://wiki.archlinux.org/title/Tor#TorDNS
	# https://~~mynixos~~.~~com~~/~~search~~?q=tor		# https://search.nixos.org/options?channel=unstable&query=services.tor

Phanirithvij: link to search.nixos.org

2025-03-15T07:18:22Z

link to search.nixos.org

← Older revision		Revision as of 07:18, 15 March 2025
Line 112:		Line 112:
	== Tips and Tricks ==		== Tips and Tricks ==
	=== Location of Option ===		=== Location of Option ===
	The global options are listed on [https://~~mynixos~~.~~com~~/~~search~~?q=tor ~~MyNixOS~~].		The global options are listed here [https://search.nixos.org/options?channel=unstable&query=services.tor services.tor.*].

	=== Relay Management ===		=== Relay Management ===

Fschn90 at 12:41, 27 February 2025

2025-02-27T12:41:44Z

← Older revision		Revision as of 12:41, 27 February 2025
Line 108:		Line 108:
	The Tor relay will require some days to advertise in the network, to the [https://metrics.torproject.org/rs.html relay index] and start generating traffic. You can query metrics about your relay on the relay index page using the name or email from the settings.		The Tor relay will require some days to advertise in the network, to the [https://metrics.torproject.org/rs.html relay index] and start generating traffic. You can query metrics about your relay on the relay index page using the name or email from the settings.

	In case your Tor relay is running behind a NAT network, be sure to forward the ORPort to your server running Tor.		In case your Tor relay is running behind a NAT network, be sure to forward the ORPort and the obfs4 Port to your server running Tor.

	== Tips and Tricks ==		== Tips and Tricks ==

Layer-09: Made Tips and Tricks titles bigger

2024-07-04T17:47:29Z

Made Tips and Tricks titles bigger

← Older revision		Revision as of 17:47, 4 July 2024
Line 1:		Line 1:
	<div style="border: 1px solid #D33; background~~-color~~: #FFEBEB; padding: ~~12px; line-height: 1.7~~; border-radius: 5px; margin: ~~5px~~ 0px;">		<div style="border: 1px solid #D33; background: #FFEBEB; padding: 30px; border-radius: 5px; margin: 10px 0px; display: flex; align-items: center;">
	<~~span~~ style="color: #D33; font-size: ~~20px~~; ~~float~~: ~~left~~; ~~margin~~-~~right~~: ~~10px~~;">⚠</~~span~~>		<div style="color: #D33; font-size: 40px; margin-right: 15px; background: #FFEBEB; display: flex; line-height: 0; align-items: center;">⚠</div>
	<div style="~~overflow~~: ~~hidden~~;"><strong>Tor is not a panacea.</strong> To achieve effective anonymity with Tor, you must understand its <strong>caveats</strong> and adjust your <strong>browsing habits</strong>. The Tor Project provides a crucial [https://support.torproject.org/faq/staying-anonymous/ list of tips] that you should read before using Tor.</div>		<div style="color: #D33; font-size: 15px; font-style: normal; font-weight: 400; line-height: normal; text-align: left;"><strong>Tor is not a panacea.</strong> To achieve effective anonymity with Tor, you must understand its <strong>caveats</strong> and adjust your <strong>browsing habits</strong>. The Tor Project provides a crucial [https://support.torproject.org/faq/staying-anonymous/ list of tips] that you should read before using Tor.</div>
	</div>		</div>

Line 110:		Line 110:
	In case your Tor relay is running behind a NAT network, be sure to forward the ORPort to your server running Tor.		In case your Tor relay is running behind a NAT network, be sure to forward the ORPort to your server running Tor.

	= Tips and Tricks =		== Tips and Tricks ==
	==== Location of Option ====		=== Location of Option ===
	The global options are listed on [https://mynixos.com/search?q=tor MyNixOS].		The global options are listed on [https://mynixos.com/search?q=tor MyNixOS].

	==== Relay Management ====		=== Relay Management ===
	Tor relays are servers that help anonymize internet traffic by routing it through a series of nodes. Each relay in the Tor network plays a crucial role in maintaining the privacy and security of users by ensuring that no single point can trace the origin and destination of the data. The primary purpose of Tor relays is to facilitate anonymous communication and protect users from network surveillance and traffic analysis.		Tor relays are servers that help anonymize internet traffic by routing it through a series of nodes. Each relay in the Tor network plays a crucial role in maintaining the privacy and security of users by ensuring that no single point can trace the origin and destination of the data. The primary purpose of Tor relays is to facilitate anonymous communication and protect users from network surveillance and traffic analysis.

Line 136:		Line 136:
	* '''Liability:''' Exit relay operators may face legal scrutiny if their relays are used for illegal activities. It is important for operators to understand the potential legal implications and take appropriate measures to protect themselves.		* '''Liability:''' Exit relay operators may face legal scrutiny if their relays are used for illegal activities. It is important for operators to understand the potential legal implications and take appropriate measures to protect themselves.

	==== Client Bridge ====		=== Client Bridge ===
	<div style="border: 1px solid #D33; background~~-color~~: #FFEBEB; padding: ~~12px; line-height: 1.7~~; border-radius: 5px; margin: ~~5px~~ 0px;">		<div style="border: 1px solid #D33; background: #FFEBEB; padding: 30px; border-radius: 5px; margin: 10px 0px; display: flex; align-items: center;">
	<~~span~~ style="color: #D33; font-size: ~~20px~~; ~~float~~: ~~left~~; ~~margin~~-~~right~~: ~~10px~~;">⚠</~~span~~>		<div style="color: #D33; font-size: 40px; margin-right: 15px; background: #FFEBEB; display: flex; line-height: 0; align-items: center;">⚠</div>
	<div style="~~overflow~~: ~~hidden~~;"~~><strong>Security Warning:</strong~~> Do not attempt to use Tor with any web browsers other than Tor Browser. Tor Browser integrates custom modifications to Firefox to enhance anonymity and ensure that information leakage does not occur. Using another web browser with Tor is likely to result in imperfect anonymity and is unsafe.</div>		<div style="color: #D33; font-size: 15px; font-style: normal; font-weight: 400; line-height: normal; text-align: left;">Do not attempt to use Tor with any web browsers other than Tor Browser. Tor Browser integrates custom modifications to Firefox to enhance anonymity and ensure that information leakage does not occur. Using another web browser with Tor is likely to result in imperfect anonymity and is unsafe.</div>
	</div>		</div>

	Tor can be enabled as a system service by enabling options {{nixos:option\|services.tor.enable}}. Configuration of tor service is an example of [https://nixos.org/manual/nixos/stable/index.html#sec-freeform-modules Freeform module], so you can pass not only explicitly supported {{nixos:option\|services.tor.settings}}, but all other [https://2019.www.torproject.org/docs/tor-manual.html.en torrc] options. For example, client bridge config can be set like this:		Tor can be enabled as a system service by enabling options {{nixos:option\|services.tor.enable}}. Configuration of tor service is an example of [https://nixos.org/manual/nixos/stable/index.html#sec-freeform-modules Freeform module], so you can pass not only explicitly supported {{nixos:option\|services.tor.settings}}, but all other [https://2019.www.torproject.org/docs/tor-manual.html.en torrc] options. For example, client bridge config can be set like this:

Line 155:		Line 156:
	By also enabling {{nixos:option\|services.tor.client.enable}}, an additional SOCKS service on port 9063 can be enabled. This is a "fast" SOCKS port suitable for browser use; a new circuit is established every ten minutes.		By also enabling {{nixos:option\|services.tor.client.enable}}, an additional SOCKS service on port 9063 can be enabled. This is a "fast" SOCKS port suitable for browser use; a new circuit is established every ten minutes.

	==== Sandboxing ====		=== Sandboxing ===

	You can also run the [[Tor Browser in a Container]].		You can also run the [[Tor Browser in a Container]].
Line 161:		Line 162:
	Alternatively, Tor can be configured together with the [[Firejail#Torify_application_traffic\|Firejail]] sandboxing solution.		Alternatively, Tor can be configured together with the [[Firejail#Torify_application_traffic\|Firejail]] sandboxing solution.

	==== Faster Reconnects on Network Switch ====		=== Faster Reconnects on Network Switch ===
	Using [[Systemd/networkd/dispatcher]] it is possible to restart the Tor daemon every time a network reconnect is performed. This avoids having to wait for Tor network timeouts and reestablishes a new connection faster.		Using [[Systemd/networkd/dispatcher]] it is possible to restart the Tor daemon every time a network reconnect is performed. This avoids having to wait for Tor network timeouts and reestablishes a new connection faster.

Line 169:		Line 170:
	An alternative approach is use both a wrapper and built-in proxy support. This way, if the application's proxy support fails, the connection is likely to be caught by the wrapper and if you run the application without the wrapper by mistake, the connections are still likely to be proxied.		An alternative approach is use both a wrapper and built-in proxy support. This way, if the application's proxy support fails, the connection is likely to be caught by the wrapper and if you run the application without the wrapper by mistake, the connections are still likely to be proxied.

	==== KDE Integration ====		=== KDE Integration ===
	'''KDE Proxy Configuration'''		'''KDE Proxy Configuration'''
	In KDE, proxy server configuration is set for all applications centrally. You should set the SOCKS proxy to Tor's default SOCKS port (127.0.0.1:9050), and set the HTTP proxy to Privoxy (127.0.0.1:8118).		In KDE, proxy server configuration is set for all applications centrally. You should set the SOCKS proxy to Tor's default SOCKS port (127.0.0.1:9050), and set the HTTP proxy to Privoxy (127.0.0.1:8118).
Line 183:		Line 184:
	KMail respects KDE-wide proxy settings, and the "safe" SOCKS port offers good isolation between mailboxes.		KMail respects KDE-wide proxy settings, and the "safe" SOCKS port offers good isolation between mailboxes.

	==== DNS over Tor ====		=== DNS over Tor ===
	<syntaxhighlight lang="nix">		<syntaxhighlight lang="nix">
	services = {		services = {
Line 205:		Line 206:
	Please refer to [https://wiki.archlinux.org/title/Tor#TorDNS ArchWiki] for details.		Please refer to [https://wiki.archlinux.org/title/Tor#TorDNS ArchWiki] for details.

	= References =		== References ==

	# https://support.torproject.org/tbb/tbb-9		# https://support.torproject.org/tbb/tbb-9

Layer-09 at 12:04, 3 July 2024

2024-07-03T12:04:25Z

← Older revision		Revision as of 12:04, 3 July 2024
Line 98:		Line 98:
	};		};
	};		};

			# Operating a Snowflake proxy helps others circumvent censorship. Safe to run.
	services.snowflake-proxy = {		services.snowflake-proxy = {
	enable = true;		enable = true;