4w ago

Realities of hosting a tor relay node at home

I am in the EU. I want to help make the TOR network more robust by contributing a relay node. I have one of three hardware options: a raspberry pi zero W, raspberry pi 4B, or ThinkPad T470s.

In your practical experience, which of these computers would be the best for the network? As I understand, beyond a point, the CPU power doesn't matter unless massive traffic loads go through the node.

P.S: Not sure if this is relevant, but I currently have a pihole hosted in a separate RPI zero. I plan to host this at home. I do not have a separate connection line. My router doesn't support vlan.

Add: Thank you for the kind replies. Based on the feedback, it think I'm currently not setup to help the network. I will instead continue with my annual contribution.

I will look into hosting a node on a VPS and just pay a monthly subscription fee or something.

22 comments

Tor operator here.
If you don’t have a second IP for your relay, don’t host at home. You will have CAPTCHAs everywhere, many sites will block you and your ISP will eventually contact you to stop degrading their IP space reputation.
Most website owners don’t discriminate between Tor exits and relays. They subscribe to block-lists that include all known Tor IP addresses. Major online services will make your browsing experience really shitty and once you’re a “known Tor IP” it will take months to remove that reputation.
You can run a Bridge instead, but you will eventually have the same problem.
- to be fair I really just used my relay for myself and didn't run into that many issues... but this IS the reality if you want to help others like you said...
- Could you route through a VPN like Torguard or something?

I have tried hosting a Tor relay on a VPS in the past and it was bottlenecked by the CPU at barely 20MB/s, although to be fair this was without hardware AES. More importantly for you, the server's IP started getting DDoSed constantly and a whole bunch of big internet services just immediately blocked the address (the list of relay IPs is public and many things just block every address on that list instead of only exit nodes). So any of your machines are probably at least somewhat up to the task (ideally if they have hardware AES support), but this is definitely not something I'd do on my home network.
- I ran a relay too way, way back in the day and I remember almost a third of the sites I used blacklisted my IP address within days. It wasn't cool.
  I ended up shutting it down, resetting my cable modem, and spoofing a new MAC address on my router to get a new IP address to get everything working again.
  Using a VPN is smarter. I wouldn't run that on IPv6 whatsoever.
  
  I am hosting a high speed relay right now, and have been for 4+ years, on my home address. I am not getting attacked beyond the usual drivebys that I'd get hit with regardless because I host other outward-facing things.
  You do look suspicious to large social media sites, but besides those: I've never been blocked from somewhere due to my relay.
  
  Why not on IPv6? If you received a /64 from your ISP and pick only one IPv6 for Tor, I don't see what the issue would be...
- Were you using ancient hardware or something? More modern CPUs shouldn't have this issue.
  Also middle nodes shouldn't be getting ddosed.

Rather than running a Tor relay, running a simple Tor bridge (e.g. via the browser add-on Snowflake as suggested by @ryokimball@infosec.pub) is probably the best thing to do with one's home hardware.
Actual relays must suffice certain requirements, according to the Tor project:
Requirements for Tor relays depend on the type of relay and the bandwidth they provide. ==== Bandwidth and Connections ====
A non-exit relay should be able to handle at least 7000 concurrent connections. This can overwhelm consumer-level routers. If you run the Tor relay from a server (virtual or dedicated) in a data center you will be fine. If you run it behind a consumer-level router at home you will have to try and see if your home router can handle it or if it starts failing. Fast exit relays (>=100 Mbit/s) usually have to handle a lot more concurrent connections (>100k).
It is recommended that a relay have at least 16 Mbit/s (Mbps) upload bandwidth and 16 Mbit/s (Mbps) download bandwidth available for Tor. More is better. The minimum requirements for a relay are 10 Mbit/s (Mbps). If you have less than 10 Mbit/s but at least 1 Mbit/s we recommend you run a [/wiki/doc/PluggableTransports/obfs4proxy bridge with obfs4 support]. If you do not know your bandwidth you can use http://beta.speedtest.net/ to measure it.
As for exit relays aka exit nodes, the obligatory advice is of course to not run them at all unless you know exactly what you are doing both legally and technically, and probably only if you're a foundation or something.

A relay node should be no issue.
An exit node is what's more difficult

For the Tor operators, how to you mitigate the risks associated with what's being trafficked across your network?
- simply don't run an exit node (from home)
  run you relay no mether the type of a cheap vps that's tor friendly

I'm a Tor relay operator. For years, I ran a Tor guard/middle relay, but I often ran into issues with certain services and websites that would blacklist my IP address within days of changing it. After dealing with that for a long time, I eventually got tired of the hassle and switched to running a Tor bridge instead, to help people bypass censorship in authoritarian countries. I think it's a better fit for a home connection.

https://snowflake.torproject.org/
I feel like I should mention the Snowflake browser plug-in, which to my understanding, creates a relay in your browser basically.
- I think snowflake is a bridge rather than a relay
- It can also be run as a standalone background service, so you don't have to have a browser window open all the time. I've run one for years. Super easy.

Any of those can host a relay, the question is what you expect the throughput to be. I don't expect the Zero W to survive 5 sustained Mbps, but the 4B and the ThinkPad should easily eat 20 sustained Mbps.

Host a middle node
Keep in mind that none of the hardware you listed is great for hosting. It could work but I would go for somethinga little more modern. Something like a i5-7500 would be great. Get a router with vlans since you probably will want to segment the network.
For networking make sure you have a solid low latency reasonable bandwidth connection. I would do gigabit fiber since that will provide a decent amount of bandwidth while having low latency.
Also you could look into running a i2p node on the same machine since they both need volunteers.

If you do end up hosting on a VPS, consider one with renewable energy since tor nodes can consume a lot of power over time - or for home setups, you could run it off a portable power station to offset electricity costs (check out power station comparisons to find the best wh value for continous loads).

Hey there are various ways to do it, but if you have a suitable bit of hardware I'd self host at home - just because! Pi 4B would be better but you can quickly get loads of traffic so if you broadband isn't great it can slow things down! If you want to host a tor relay and self host other stuff there are means and ways to do that as well. I have run a tor relay before through yunohost for example

there is an official docker container to run a bridge, which is probably the easiest option. no idea if it supports pi/arm though.

22 comments