Tor provides a distributed network of servers ("onion routers"). Users bounce their communications (web requests, IM, IRC, SSH, etc.) around the routers. This makes it hard for recipients, observers, and even the onion routers themselves to track the source of the stream.
Individuals need Tor for privacy:
Journalists and NGOs need Tor for safety:
Companies need Tor for business security:
Governments need Tor for traffic-analysis-resistant communication:
Law enforcement needs Tor for safety:
Does the idea of sharing the Tor network with all of these groups bother you? It shouldn't -- you need them for your security.
You can run Tor in either client mode or server mode. By default, everybody is a client. This means you don't relay traffic for anybody but yourself.
If your computer doesn't have a routable IP address or you're using a modem, you should stay a client. Otherwise, please consider being a server, to help out the network. (Currently each server uses 20-500 gigabytes of traffic per month, depending on its capacity and its rate limiting configuration.)
Note that you can be a server without allowing users to make connections from your computer to the outside world. This is called being a middleman server.
Benefits of running a server include:
Other things to note:
You can read more about setting up Tor as a server below.
We have installers for Windows, Mac OS X 10.3, and Red Hat. We have contributed packages for Debian, Gentoo, and *BSD. See the download page for pointers and details.
If you got Tor from a tarball, unpack it: tar xzf tor-0.1.0.10.tar.gz; cd tor-0.1.0.10. Run ./configure, then make, and then make install (as root if necessary). Then you can launch tor from the command-line by running tor. Otherwise, if you got it prepackaged, these steps are already done for you, and you may even already have Tor started in the background (logging to /var/log/something).
In any case, see the next section for what to do with it now that you've got it running.
Tor comes configured as a client by default. It uses a built-in default configuration file, and most people won't need to change any of the settings.
See the Windows instructions or the OS X instructions if you're using those. The below are generic instructions for Linux, BSD, Solaris, etc.
After installing Tor, you should install privoxy, which is a filtering web
proxy that integrates well with Tor. (If you installed the Win32 or OS
X package, see those instructions instead.)
To configure privoxy to use Tor, add the line
forward-socks4a / localhost:9050 .
(don't forget the dot) to privoxy's config file (you can just add it to the
top). Then change your browser to http proxy at localhost port 8118.
(In Firefox on Linux, this is in Edit|Preferences|Advanced|Proxies.)
You should also set your SSL proxy to the same
thing, to hide your SSL traffic. Using privoxy is necessary because
most
browsers leak your
DNS requests when they use a SOCKS proxy directly. Privoxy also gives
you good html scrubbing.
To test if it's working, you need to know your normal IP address so you can verify that the address really changes when running Tor. If you are using Linux or OS X your local IP address is shown by the ifconfig command. Under Windows go to the Start menu, click Run and enter cmd. At the command prompt, enter ipconfig. If you are behind a NAT/Firewall you can use one of the sites listed below to check which IP you are using. When that is done, start Tor and Privoxy and visit any of the sites again. If everything works, your IP address should have changed.
showmyip.com and ipid.shat.net are sites that show your current IP so you can see what address and country you're coming from.
If you have a personal firewall that limits your computer's ability to connect to itself, be sure to allow connections from your local applications to local port 8118 and port 9050. If your firewall blocks outgoing connections, punch a hole so it can connect to at least TCP ports 80, 443, and 9001-9033. For more troubleshooting suggestions, see the FAQ.
To Torify an application that supports http, just point it at Privoxy (that is, localhost port 8118). To use SOCKS directly (for example, for instant messaging, Jabber, IRC, etc.), point your application directly at Tor (localhost port 9050). For applications that support neither SOCKS nor http, you should look at using tsocks to dynamically replace the system calls in your program to route through Tor. If you want to use SOCKS 4A, consider using socat (specific instructions are on this hidden service url).
(Windows doesn't have tsocks; see the bottom of the Win32 instructions for alternatives.)
We're looking for people with reasonably reliable Internet connections, that have at least 20 kilobytes/s each way. If you frequently have a lot of packet loss or really high latency, we can't handle your server yet. Otherwise, please help out!
To read more about whether you should be a server, check out the section above.
To set up a Tor server, do the following steps after installing Tor. (These instructions are Unix-centric; but Tor 0.0.9.5 and later is running as a server on Windows now as well.)
Here's where Tor puts its files on many common platforms:
| Unix | Windows | Mac OS X | |
|---|---|---|---|
| Configuration | /etc/torrc or /usr/local/etc/torrc |
\username\Application Data\tor\torrc or \Application Data\tor\torrc |
/Library/Tor/torrc |
| Fingerprint | /var/lib/tor/fingerprint or /usr/local/var/lib/tor/fingerprint | \username\Application Data\tor\fingerprint or \Application Data\tor\fingerprint | /Library/Tor/var/lib/tor/fingerprint |
| Logs | /var/log/tor or /usr/local/var/log/tor | \username\Application Data\tor\torrc or \Application Data\tor\log | /var/log/tor |
Optionally, we recommend the following steps as well:
You can click here or here and look at the router-status line to see if your server is part of the network. It will be listed by nickname once we have added your server to the list of known servers; otherwise it is listed only by its fingerprint.
Tor allows clients and servers to offer hidden services. That is, you can offer a web server, SSH server, etc., without revealing your IP to its users. You can even have your application listen on localhost only, yet remote Tor connections can access it. This works via Tor's rendezvous point design: both sides build a Tor circuit out, and they meet in the middle.
If you're using Tor and Privoxy, you can go to the hidden wiki to see hidden services in action.
To set up a hidden service, copy torrc.sample to torrc (by default it's in /usr/local/etc/tor/), and edit the middle part. Then run Tor. It will create each HiddenServiceDir you have configured, and it will create a 'hostname' file which specifies the url (xyz.onion) for that service. You can tell people the url, and they can connect to it via their Tor client, assuming they're using a proxy (such as Privoxy) that speaks SOCKS 4A.
Let's consider an example. Assume you want to set up a hidden service to allow people to access your Apache web server through Tor. By doing this, they can access your server but won't know who they are connecting to. You want clients to use the standard port 80 when accessing your server. However, if your Apache server is actually running on port 8080 locally, client connections need to be redirected.
HiddenServiceDir is a directory where Tor will store information about that hidden service. In particular, Tor will create a file here named hostname which will tell you the onion URL. You don't need to add any files to this directory.
HiddenServicePort is where you specify a virtual port and where to redirect connections to this virtual port. For instance, you tell Tor there's a virtual port 80 and then redirect traffic to your local webserver at 127.0.0.1:8080.
Example lines from a torrc file
HiddenServiceDir /usr/local/etc/tor/hidden_service/ HiddenServicePort 80 127.0.0.1:8080
This tells Tor to store its files in /usr/local/etc/tor/hidden_service/ and allow people to connect to your onion address on port 80. It will then redirect requests to your localhost webserver on port 8080.
To let people access your hidden service, look at the file /usr/local/etc/tor/hidden_service/hostname which will tell you what the hostname is (such as xyz.onion). Then, as long as they have Tor and Privoxy configured, they can access your webserver with a web browser by connecting to http://xyz.onion/
You can have multiple tor hidden services by repeating Dir and Ports:
HiddenServiceDir /usr/local/etc/tor/hidden_service/ HiddenServicePort 80 127.0.0.1:8080 HiddenServiceDir /usr/local/etc/tor/other_hidden_service/ HiddenServicePort 6667 127.0.0.1:6667 HiddenServicePort 22 127.0.0.1:22
The above example will allow people to connect to the hostname in /usr/local/etc/tor/hidden_service/hostname for an HTTP server and to a different hostname in /usr/local/etc/tor/other_hidden_service/hostname for an IRC and SSH server. To an end user, this appears to be two separate hosts with one running an HTTP server and another running an IRC/SSH server.
If you want to experiment locally with your own network, or you're cut off from the Internet and want to be able to mess with Tor still, then you may want to set up your own separate Tor network.
To set up your own Tor network, you need to run your own directory servers, and you need to configure each client and server so it knows about your directory servers rather than the default ones.