This depends entirely on how you installed it and which operating system you have. If you installed a package, then hopefully your package has a way to uninstall itself. Windows has the uninstaller functionality. The proper way to completely remove Tor, Vidalia, Torbutton for Firefox, and Privoxy on any version of Windows is as follows:

In your taskbar, right click on Privoxy (the blue icon with a white "P") and choose exit.
In your taskbar, right click on Vidalia (the green onion) and choose exit.
Right click on the taskbar to bring up TaskManager. Look for tor.exe in the Process List. If it's running, right click and choose End Process.
Click the Start button, go to Programs, go to Vidalia, choose Uninstall. This will remove the Vidalia bundle, which includes Tor and Privoxy.
Start Firefox. Go to the Tools menu, choose Add-ons. Select Torbutton. Click the Uninstall button.

If you do not follow these steps, and merely try to uninstall Vidalia, Tor, and Privoxy, while they are still running, you need to reboot and manually remove the directory "Program Files\Vidalia Bundle".

For Mac OS X, follow the uninstall directions.

If you installed by source, I'm afraid there is no easy uninstall method. But on the bright side, by default it only installs into /usr/local/ and it should be pretty easy to notice things there.

2.2. What are these ".asc" signature files in the dist/ directory?

[link]

These are PGP signatures, so you can verify that the file you've downloaded is exactly the one that we intended you to get.

Please read the TheOnionRouter/VerifyingSignatures page for details.

2.3. How do I compile Tor under Windows?

[link]

Try following the steps at https://www.torproject.org/svn/trunk/doc/tor-win32-mingw-creation.txt.

You can also try following the (somewhat outdated) instructions at https://tor.addicts.nl/windows/.

2.4. Why does my Tor executable appear to have a virus or spyware?

[link]

Sometimes, overzealous Windows virus and spyware detectors trigger on some parts of the Tor Windows binary. Our best guess is that these are false positives --- after all, the anti-virus and anti-spyware business is just a guessing game anyway. You should contact your vendor and explain that you have a program that seems to be triggering false positives. Or pick a better vendor.

In the meantime, we encourage you to not just take our word for it. Our job is to provide the source; please do recompile it yourself.

2.5. Is there a LiveCD or other bundle that includes Tor?

[link]

There isn't any official LiveCD at this point. We're still trying to find good solutions and trying to understand the security and anonymity implications of the various options. In the mean time, feel free to check out the list below and use your best judgement:

Maintained:

JanusVM is a Linux kernel and software running in VMWare that sits between your Windows computer and the Internet, making sure that your Internet traffic is scrubbed and anonymized.
xB Browser, previously known as Torpark, is a Firefox+Tor package for Win32 that can installed on a USB key. It needs a host Win32 operating system.
TorK LiveCD is Knoppix-based with an emphasis on user-friendliness. You can work anonymously or non-anonymously while TorK tries to keep you informed of the consequences of your activity. The TorK LiveCD is experimental, so the aim is to provide regular releases through 2007 and beyond.
Polippix / Privatlivets Fred is a Danish Knoppix-based LiveCD with TOR
and utilities to encrypt IP-telephony. Info and download.
Incognito LiveCD/USB is a CD you can boot that has several Internet applications (Firefox, IRC, Mail, etc) pre-configured to use Tor. For most computers everything is automatically configured and you're ready to go. You can even copy the CD to a USB drive. Includes TorK.
Privatix LiveCD/USB is a debian based live-system including tor, firefox and torbutton which can save bookmarks and other settings or data on an encrypted usb-key
[add yours here!]

Not currently maintained as far as we know:

ELE is a Linux LiveCD which is focused on privacy related
software. It includes Tor and you can download it at
http://www.northernsecurity.net/download/ele/.
Virtual Privacy Machine is a Linux LiveCD that includes Firefox, Privoxy, Tor, some IRC and IM applications, and a set of ipchains rules aimed to prevent non-Tor traffic from accidentally leaving your computer. More information at
http://wiki.noreply.org/noreply/VirtualPrivacyMachine.
Anonym.OS is a LiveCD similar to the above but is based on OpenBSD rather than Linux for maximum security. It was designed to be anonymous and secure from the ground up, and thus has some features and limitations not found in other LiveCDs (Tor related or otherwise). You can obtain more information and download Anonym.OS from
Kaos.Theory.
Phantomix is a LiveCD for anonymous surfing and chatting based on the most recent KNOPPIX release. It comes preconfigured with tor and privoxy. You can get it from the
Phantomix Website.

3. Running Tor

[link]

3.1. I'm supposed to "edit my torrc". What does that mean?

[link]

Tor installs a text file called torrc that contains configuration instructions for how your Tor program should behave.

The location of your torrc file depends on the way you installed Tor.

On Windows, if you installed a Tor bundle with Vidalia, you
can find your torrc file in the Start menu under Programs -> Vidalia Bundle -> Tor, or you can find it by hand in \Documents and Settings\username\Application Data\Vidalia\torrc. If you installed Tor without Vidalia, you can find your torrc in the Start menu under Programs -> Tor, or manually in either \Documents and Settings\Application Data\tor\torrc or \Documents and Settings\username\Application Data\tor\torrc.
On OS X, if you use Vidalia, edit ~/.vidalia/torrc, otherwise open your favorite text editor and load /Library/Tor/torrc
On Unix, if you installed a pre-built package, look for /etc/torrc or /etc/tor/torrc or consult your package's documentation.
Finally, if you installed from source, you may not have a torrc installed yet: look in /usr/local/etc/ and note that you may need to manually copy torrc.sample to torrc

The default torrc file should work fine for most Tor users. You will need to edit it if you want to start relaying traffic for others (that is, become a Tor relay). For other configuration options you can use, look at the Tor man page.

Once you've changed your torrc, you will need to restart Tor for the changes to take effect. (For advanced users on OS X and Unix, note that you actually only need to send Tor a HUP signal, not actually restart it.)

Remember, all lines beginning with # in torrc are treated as comments and have no effect on Tor's configuration.

3.2. How do I set up logging, or see Tor's logs?

[link]

If you installed a Tor bundle with Vidalia, then Vidalia has a window called "Message Log" that will show you Tor's log messages. You can click on "Settings" to see more details, or to save the messages to a file also. You're all set.

If you're not using Vidalia, you'll have to go find the log files by hand as described below.

By default, Tor logs to "standard out" (also knows as "stdout") at log-level notice. However, some Tor packages (notably the ones for OS X, Debian, Red Hat, etc) change the default logging so it logs to a file, and then Tor runs in the background.

If you're using a pre-packaged Tor, here are some likely places for your logs to go by default:

On Windows, there are no default log files currently. If you configure logging to a file in your torrc, they will show up in \username\Application Data\tor\log\ or \Application Data\tor\log\
On OS X, Debian, Red Hat, etc, the logs are in /var/log/tor/
If you compiled Tor from source, your logs will go to /usr/local/var/log/tor/, but only if you enable them in the torrc file.

If you want to change your logging setup, open your torrc in an editor.

Find the section (near the top of the file) which contains the following line:

##Logs go to stdout at level "notice" unless redirected by something else, like one of the below lines.

Now, assuming you want Tor to send complete debug, info, notice, warn, and err level messages to a file, append the following line to the end of the section:

Log debug file c:/program files/tor/debug.log

Replace "c:/program files/tor/debug.log" with a directory/filename for your Tor log.

If you also want Tor to output to stdout, append the following line to the section as well:

Log notice stdout

3.3. What log level should I use?

[link]

There are five log levels (also called "log severities") you might see in Tor's logs:

"err": something bad just happened, and we can't recover. Tor will exit.
"warn": something bad happened, but we're still running. The bad thing might be a bug in the code, some other Tor process doing something unexpected, etc. The operator should examine the message and try to correct the problem.
"notice": something the operator will want to know about.
"info": something happened (maybe bad, maybe ok), but there's nothing you need to (or can) do about it.
"debug": for everything louder than info. It is quite loud indeed.

Alas, some of the warn messages are hard for ordinary users to correct -- the developers are slowly making progress at making Tor automatically react correctly for each situation.

We recommend running at the default, which is "notice". You will hear about important things, and you won't hear about unimportant things.

Tor relays in particular should avoid logging at info or debug in normal operation, since they might end up recording sensitive information in their logs.

3.4. Do I have to open all these outbound ports on my firewall?

[link]

Tor may attempt to connect to any port that is advertised in the directory as an ORPort (for making Tor connections) or a DirPort (for fetching updates to the directory). There are a variety of these ports, but many of them are running on 80, 443, 9001, and 9030.

So as a client, you could probably get away with opening only those four ports. Since Tor does all its connections in the background, it will retry ones that fail, and hopefully you'll never have to know that it failed, as long as it finds a working one often enough. However, to get the most diversity in your entry nodes -- and thus the most security -- as well as the most robustness in your connectivity, you'll want to let it connect to all of them.

If you really need to connect to only a small set of ports, see the FAQ entry on firewalled ports.

Note that if you're running as a Tor relay, you must allow outgoing connections to every other relay, and to anywhere your exit policy advertises that you allow. The cleanest way to do that is to simply allow all outgoing connections at your firewall. If you don't, clients will try to use these connections and things won't work.

3.5. My Tor keeps crashing.

[link]

We want to hear from you! There are supposed to be zero crash bugs in Tor. This FAQ entry describes the best way for you to be helpful to us. But even if you can't work out all the details, we still want to hear about it, so we can help you track it down.

First, make sure you're using the latest version of Tor (either the latest stable or the latest development version).

Second, make sure your version of libevent is new enough. We recommend at least libevent 1.3a.

Third, see if there's already an entry for your bug in the Tor bugtracker. If so, check if there are any new details that you can add.

Fourth, is the crash repeatable? Can you cause the crash? Can you isolate some of the circumstances or config options that make it happen? How quickly or often does the bug show up? Can you check if it happens with other versions of Tor, for example the latest stable release?

Fifth, what sort of crash do you get?

Does your Tor log include an "assert failure"? If so, please tell us that line, since it helps us figure out what's going on. Tell us the previous couple of log messages as well, especially if they seem important.
If it says "Segmentation fault - core dumped" then you need to do a bit more to track it down. Look for a file like "core" or "tor.core" or "core.12345" in your current directory, or in your Data Directory. If it's there, run "gdb tor core" and then "bt", and include the output. If you can't find a core, run "ulimit -c unlimited", restart Tor, and try to make it crash again. (This core thing will only work on Unix -- alas, tracking down bugs on Windows is harder. If you're on Windows, can you get somebody to duplicate your bug on Unix?)
If Tor simply vanishes mysteriously, it probably is a segmentation fault but you're running Tor in the background (as a daemon) so you won't notice. Go look at the end of your log file, and look for a core file as above. If you don't find any good hints, you should consider running Tor in the foreground (from a shell) so you can see how it dies. Warning: if you switch to running Tor in the foreground, you might start using a different torrc file, with a different default Data Directory; see
the relay-upgrade FAQ entry for details.
If it's still vanishing mysteriously, perhaps something else is killing it? Do you have resource limits (ulimits) configured that kill off processes sometimes? (This is especially common on OpenBSD.) On Linux, try running "dmesg" to see if the out-of-memory killer removed your process. (Tor will exit cleanly if it notices that it's run out of memory, but in some cases it might not have time to notice.) In very rare circumstances, hardware problems could also be the culprit.

Sixth, if the above ideas don't point out the bug, consider increasing your log level to "loglevel debug". You can look at the log-configuration FAQ entry for instructions on what to put in your torrc file. If it usually takes a long time for the crash to show up, you will want to reserve a whole lot of disk space for the debug log. Alternatively, you could just send debug-level logs to the screen (it's called "stdout" in the torrc), and then when it crashes you'll see the last couple of log lines it had printed. (Note that running with verbose logging like this will slow Tor down considerably, and note also that it's generally not a good idea security-wise to keep logs like this sitting around.)

4. Running a Tor client

[link]

4.1. I installed Tor and Privoxy but it's not working.

[link]

Are you sure Tor and Privoxy are both running? If you're using Vidalia, you may have to click on the onion and select "Start" to launch Tor.

Did you configure your web browser to http proxy to port 8118? Most people should do this simply by installing Torbutton and making sure it says "Tor enabled" at the bottom.

If you are using Firefox and would like to use Tor via the Torbutton extension, make sure you don't have any other proxy add-on such as FoxyProxy enabled, as it will bypass Torbutton's proxy settings for your browser. Note that using FoxyProxy is NOT a sufficient substitute for Torbutton. There are many known attacks against a browser setup that does not include Torbutton. Read more in the Torbutton FAQ and the Torbutton design specification.

Check your Tor logs. Do they give you any hints about what's going wrong?

Check your system clock. If it's more than a few hours off, Tor will refuse to build circuits. For XP users, synchronize your clock under the clock -> Internet time tab. In addition, correct the day and date under the 'Date & Time' Tab.

Is your Internet connection firewalled, or do you normally need to use a proxy? Are you running programs like Norton Internet Security that block certain connections, even though you don't realize they do?

If you installed Privoxy yourself (not from a bundle), did you edit the Privoxy config file as described? Did you remember to put the "." at the end of the Privoxy config line? Did you accidentally comment the config line out? Did you restart Privoxy after this change?

For Red Hat Linux and related systems, do you have SELinux enabled? If so, it might be preventing Privoxy from talking to Tor. We also run across BSD users periodically who have local firewall rules that prevent some connections to localhost.

When it's working, Tor should report that it 'has successfully opened a circuit. Looks like client functionality is working.'

4.2. How can I tell if Tor is working, and that my connections really are anonymized? Are there external servers that will test my connection?

[link]

Once you've set up your browser to point to Privoxy, and (if necessary) your Privoxy to point to Tor, there are sites you can visit that will tell you if you appear to be coming through the Tor network. Try the Tor Check site and see whether it thinks you are using Tor or not.

If that site is down, you can still test, but it will involve more effort: http://ipid.shat.net and http://www.showmyip.com/ will tell you what your IP address appears to be, but you'll need to know your current IP address so you can compare and decide whether you're using Tor correctly.

To learn your IP address on OS X, Linux, BSD, etc, run "ifconfig". On Windows, go to the Start menu, click Run and enter "cmd". At the command prompt, enter "ipconfig /a".

If you are behind a NAT or firewall, though, your IP address will show up as something like 192.168.1.1 or 10.10.10.10, and this isn't your public IP address. In this case, you should 1) configure your browser to connect directly (that is, stop using Privoxy), 2) check your IP address with one of the sites above, 3) point your browser back to Privoxy, and 4) see whether your IP address has changed.

4.3. Why does Privoxy keep telling me "resolve failed"?

[link]

Unfortunately, Privoxy only has one error message. So no matter what went wrong, it will tell you "resolve failed".

You might have better luck looking at Tor's log messages.

If you're technically inclined, you'll probably be happier setting up Polipo rather than Privoxy: it provides much more useful error messages.

(One day the bundles will come with Polipo rather than Privoxy --- and that day will come sooner if you help!)

4.4. How do I use my browser for ftp with Tor?

[link]

The short answer is to use Firefox 1.5 or above with Torbutton. With this configuration, accessing ftp:// links should be safe for you: your Firefox will safely use Tor directly as a socks proxy when accessing these links.

Versions of Firefox older than 1.5 don't know how to use a socks proxy without broadcasting your DNS queries to the local network, so in those cases you should avoid ftp:// links. Torbutton will automatically configure your browser in this case to point all protocols to Privoxy: this means that ftp connections will fail, but at least they won't be dangerous.

If you're using a different browser, we wish you luck. Most of them don't support doing socks requests without leaking the DNS resolve, so you will want to set as many proxy lines as you can. Internet Explorer users beware --- there is a known bug that causes Explorer to directly send FTP requests without going through the specified proxy. You should at least disable Folder View in Internet Explorer if using Tor with Privoxy, and you may need to take other steps as well.

If you want a separate application for an ftp client, we've heard good things about FileZilla for Windows. You can configure it to point to Tor as a "socks4a" proxy on "localhost" port "9050".

4.5. Does Tor remove personal information from the data my application sends?

[link]

No, it doesn't. You need to use a separate program that understands your application and protocol and knows how to clean or "scrub" the data it sends. Privoxy is an example of this for web browsing. But note that even Privoxy won't protect you completely: you may still fall victim to viruses, Java Script attacks, etc; and Privoxy can't do anything about text that you type into forms. Be careful and be smart.

4.6. I want to run my Tor client on a different computer than my applications.

[link]

By default, your Tor client only listens for applications that connect from localhost. Connections from other computers are refused. If you want to torify applications on different computers than the Tor client, you should edit your torrc to define SocksListenAddress 0.0.0.0 and then restart (or hup) Tor. If you want to get more advanced, you can configure your Tor client on a firewall to bind to your internal IP but not your external IP. (For a complete example of this, see Tor through SSH tunnel using a web browser on Debian to connect to a Tor client running on OpenBSD. The data is transferred between the computers using an SSH tunnel.)

If you are using tor through privoxy, or using the Firefox Torbutton plugin with privoxy (the default arrangement) you will need to edit your privoxy config file so that your 'forward-socks4a' line reads something like the following:

forward-socks4a / 192.168.1.2:9100 .

Where 192.168.1.2 is the address on your local network where your tor relay is running.

For a more flexible plugin alternative to Torbutton, see the Tor SwitchProxy howto.

For more information on setting up a central tor server, see Can I install Tor on a central server, and have my clients connect to it?

4.7. How often does Tor change its paths?

[link]

Tor will reuse the same circuit for new TCP streams for 10 minutes, as long as the circuit is working fine. (If the circuit fails, Tor will switch to a new circuit immediately.)

But note that a single TCP stream (e.g. a long IRC connection) will stay on the same circuit forever -- we don't rotate individual streams from one circuit to the next. Otherwise an adversary with a partial view of the network would be given many chances over time to link you to your destination, rather than just one chance.

4.8. Why does netstat show these outbound connections?

[link]

Because that's how Tor works. It holds open a handful of connections so there will be one available when you need one.

4.9. Tor uses hundreds of bytes for every IRC line. I can't afford that!

[link]

Tor sends data in chunks of 512 bytes (called "cells"), to make it harder for intermediaries to guess exactly how many bytes you're communicating at each step. This is unlikely to change in the near future -- if this increased bandwidth use is prohibitive for you, I'm afraid Tor is not useful for you right now.

We have been considering one day adding two classes of cells -- maybe a 64 byte cell and a 1024 byte cell. This would allow less overhead for interactive streams while still allowing good throughput for bulk streams. But since we want to do a lot of work on quality-of-service and better queuing approaches first, you shouldn't expect this change anytime soon (if ever).

4.10. Can I control what nodes I use for entry/exit?

[link]

Yes. You can set preferred entry and exit nodes as well as inform Tor which nodes you do not want to use. The following options can be added to your config file "torrc" or specified on the command line:

entrynodes $fingerprint,$fingerprint,...
- A list of preferred nodes to use for the first hop in the circuit, if possible.
exitnodes $fingerprint,$fingerprint,...
- A list of preferred nodes to use for the last hop in the circuit, if possible.
excludenodes $fingerprint,$fingerprint,...
- A list of nodes to never use when building a circuit.

We recommend you do not use these -- they are intended for testing and may disappear in future versions. You get the best security that Tor can provide when you leave the route selection to Tor; overriding the entry / exit nodes can mess up your anonymity in ways we don't understand.

The entrynodes and exitnodes config options are treated as a request, meaning if the nodes are down or seem slow, Tor will still avoid them. You can make the option mandatory by setting StrictExitNodes 1 or StrictEntryNodes 1 -- but if you do, your Tor connections will stop working if all of the nodes you have specified become unreachable. See the Tor status pages for some nodes you might pick.

If you want to choose the exit node for a specific request, you can give the hostname as hostname.$fingerprint.exit (e.g. http://cnn.com.$A3035DE0545C24A9EA0D87F5FB7E4098DED0C4FF.exit). This will work fine if you're using Privoxy. You can also install Blossom, which is a client-side Tor controller that lets you specify what country you want to exit from when accessing a given resource.

If you want to access a service directly through Tor's SOCKS interface (eg. using ssh via connect.c), another option is to set up an internal mapping in your configuration file using MapAddress. See the manual page for details.

4.11. Google tells me I have spyware installed.

[link]

This is a known and intermittent problem; it does not mean that Google considers Tor to be spyware. Instead, Google tries to detect certain kinds of spyware or viruses that send distinctive queries to Google Search. It then notes the IP addresses from which those queries are received. Finally, Google tries to warn the users of those IP addresses that it received queries indicating an infection.

When you use Tor, you are sending queries through exit nodes that are also shared by thousands of other users. If some of those users are infected with software that Google detects, Google may mistakenly conclude that the exit nodes themselves are infected (because the requests appeared to originate from the exit nodes) and, for a limited period of time, will try (incorrectly) to warn all Google users who share an exit node with an infected machine that they are themselves infected.

You may also get this sort of message when lots of Tor users are querying Google in a short period of time. Google interprets the high volume of traffic as somebody trying to "crawl" their website, so it slows down traffic from that IP address for a short time.

To our knowledge, Google is not doing anything intentionally specifically to deter or block Tor use. The error message about an infected machine should clear up again after a short time.

If we think of a measure that would prevent users from seeing this sort of spurious warning message, we will certainly suggest it to Google and to other web site developers. There may also be technical workarounds for Tor end-users affected by this problem; if you find a useful workaround and write up a description of it, please let us know.

4.12. Why does Google show up in foreign languages?

[link]

Google uses "geolocation" to determine where in the world you are, so it can give you a personalized experience. This includes using the language it thinks you prefer, and it also includes giving you different results on your queries.

If you really want to see Google in English you can click the link that provides that. But we consider this a feature with Tor, not a bug --- the Internet is not flat, and it in fact does look different depending on where you are. This feature reminds people of this fact.

Note that Google search URLs take name/value pairs as arguments and one of those names is "hl". If you set "hl" to "en" then Google will return search results in English regardless of what Google server you have been sent to. On a query this looks like: http://google.com/search?q=...&hl=en&..

In Firefox you can search for the google.src file and add the line <input name="hl" value="en"> to it. Then restart Firefox and it will automatically add the "hl=en" name/value pair to all queries made from the search bar so you will get English results regardless of which Google server you have been sent to. Note that this file is actually 'hidden' as part of the application container on Macs. To get to this file on a Mac you have to right click on the Firefox application icon and select "Show Package Contents" then navigate to Contents/MacOS/searchplugins.

Another method is to simply use your country code for accessing Google. This can be google.be, google.de, google.us and so on. You can also set your language by first selecting it in Language Tools section, search for something simple. Then extract the language from the URL. In this example, we'll choose Hebrew: http://www.google.com/search?lr=lang_iw. Next, use that string in the url: http://google.com/intl/iw/. This can obviously be set as your homepage or bookmarked if necessary.

4.13. How do I access Tor hidden services?

[link]

Tor hidden services are named with a special top-level domain (TLD) name in DNS: .onion. Since the .onion TLD is not recognized by the official root DNS servers on the Internet, your application will not get the response it needs to locate the service. Currently, the Tor directory server provides this look-up service; and thus the look-up request must get to the Tor network.

Therefore, your application needs to pass the .onion hostname to Tor directly. You can't try to resolve it to an IP address, since there is no corresponding IP address: the server is hidden, after all!

So, how do you make your application pass the hostname directly to Tor? You can't use SOCKS 4, since SOCKS 4 proxies require an IP from the client (a web browser is an example of a SOCKS client). Even though SOCKS 5 can accept either an IP or a hostname, most applications supporting SOCKS 5 try to resolve the name before passing it to the SOCKS proxy. SOCKS 4a, however, always accepts a hostname: You'll need to use SOCKS 4a.

Some applications, such as the browsers Mozilla Firefox and Apple's Safari, support sending DNS queries to Tor's SOCKS 5 proxy. Most web browsers don't support SOCKS 4a very well, though. The workaround is to point your web browser at an HTTP proxy, and tell the HTTP proxy to speak to Tor with SOCKS 4a. We recommend Privoxy as your HTTP proxy.

For applications that do not support HTTP proxy, and so cannot use Privoxy, FreeCap is an alternative. When using FreeCap set proxy protocol to SOCKS 5 and under settings set DNS name resolving to remote. This will allow you to use almost any program with Tor without leaking DNS lookups and allow those same programs to access hidden services.

4.14. My Internet connection requires an HTTP proxy.

[link]

Check out the HttpProxy and HttpsProxy config options in the man page. You will need an http proxy for doing GET requests to fetch the Tor directory, and you will need an https proxy for doing CONNECT requests to get to Tor relays. (It's fine if they're the same proxy.)

Also check out HttpProxyAuthenticator and HttpsProxyAuthenticator if your proxy requires auth. We only support basic auth currently, but if you need NTLM authentication, check out this post in the archives.

If your proxies only allow you to connect to certain ports, look at the entry below on Firewalled clients for how to restrict what ports your Tor will try to access.

4.15. My firewall only allows a few outgoing ports.

[link]

If your firewall works by blocking ports, then you can tell Tor to only use the ports that your firewall permits by adding "FascistFirewall 1" to your torrc configuration file.

By default, when you set this Tor assumes that your firewall allows only port 80 and port 443 (HTTP and HTTPS respectively). You can select a different set of ports with the FirewallPorts option.

As of Tor 0.1.1.14-alpha, we've replaced FascistFirewall and FirewallPorts with new config options:

  ReachableDirAddresses *:80
  ReachableORAddresses *:443

4.16. Is there a list of default exit ports?

[link]

The default open ports are listed below but keep in mind that, any port or ports can be opened by the relay operator by configuring it in torrc or modifying the source code. But the default according to tor.1.in from the source code release tor-0.1.0.8-rc is:


reject 0.0.0.0/8	//Reject non-routable IP's requests
reject 169.254.0.0/16	//Reject non-routable IP's requests
reject 127.0.0.0/8	//Reject non-routable IP's requests
reject 192.168.0.0/16	//Reject non-routable IP's requests
reject 10.0.0.0/8	//Reject non-routable IP's requests
reject 172.16.0.0/12	//Reject non-routable IP's requests
reject *:25	//Reject SMTP for anti-spam purposes
reject *:119	//Reject NNTP (News Network Transfer Protocol)
reject *:135-139	//Reject NetBIOS (File sharing for older versions of windows)
reject *:445	//Reject Microsoft-DS (a.k.a NetBIOS for newer NT versions)
reject *:1214	//Reject Kazaa
reject *:4661-4666	//Reject eDonkey network
reject *:6346-6429	//Reject Gnutella networks
reject *:6699	//Reject Napster
reject *:6881-6999	//Reject (Dark Star) deltasource & Bittorrent network
accept :"	//Accept the rest of 65535 possible ports

Thanks to http://www.seifried.org for port references.

4.17. What should I do if I can't use an http proxy with my application?

[link]

On Unix, you might try tsocks, but it doesn't seem to work so well on FreeBSD, we'd be happy to hear about alternatives; You might also try socat. It might not be as seamless as tsocks, but it's worked where the former hasn't. There is also proxychains, but I can't get it to play nicely with Tor at the moment.

For FreeBSD and OpenBSD, you can try dante instead of tsocks. Both have a port and package for dante. Instead of running torify irssi you would run socksify irssi after properly setting up dante. See Tor chrooted in OpenBSD for an example dante configuration that works with Tor.

On windows, look at sockscap, or maybe freecap if you prefer free software.

4.18. I keep seeing these warnings about SOCKS and DNS and information leaks. Should I worry?

[link]

The warning is:

Your application (using socks5 on port %d) is giving Tor only an IP address.
Applications that do DNS resolves themselves may leak information. Consider
using Socks4A (e.g. via privoxy or socat) instead.

If you are running Tor to get anonymity, and you are worried about an attacker who is even slightly clever, then yes, you should worry. Here's why.

The Problem. When your applications connect to servers on the Internet, they need to resolve hostnames that you can read (like www.torproject.org) into IP addresses that the Internet can use (like 209.237.230.66). To do this, your application sends a request to a DNS server, telling it the hostname it wants to resolve. The DNS server replies by telling your application the IP address.

Clearly, this is a bad idea if you plan to connect to the remote host anonymously: when your application sends the request to the DNS server, the DNS server (and anybody else who might be watching) can see what hostname you are asking for. Even if your application then uses Tor to connect to the IP anonymously, it will be pretty obvious that the user making the anonymous connection is probably the same person who made the DNS request.

Where SOCKS comes in. Your application uses the SOCKS protocol to connect to your local Tor client. There are 3 versions of SOCKS you are likely to run into: SOCKS 4 (which only uses IP addresses), SOCKS 5 (which usually uses IP addresses in practice), and SOCKS 4a (which uses hostnames).

When your application uses SOCKS 4 or SOCKS 5 to give Tor an IP address, Tor guesses that it 'probably' got the IP address non-anonymously from a DNS server. That's why it gives you a warning message: you probably aren't as anonymous as you think.

So what can I do? We describe a few solutions below.

If your application speaks SOCKS 4a, use it.
For HTTP (web browsing), either configure your browser to perform remote DNS lookups (see the Torify HOWTO how to do this for some versions of Firefox) or use a socks4a-capable HTTP proxy, such as Privoxy. See the Tor documentation for more information. For instant messaging or IRC, use Gaim or XChat. For other programs, consider using freecap (on Win32) or dsocks (on BSD).
If you only need one or two hosts, or you are good at programming, you may be able to get a socks-based port-forwarder like socat to work for you; see the Torify HOWTO for examples.
Tor ships with a program called tor-resolve that can use the Tor network to look up hostnames remotely; if you resolve hostnames to IPs with tor-resolve, then pass the IPs to your applications, you'll be fine. (Tor will still give the warning, but now you know what it means.)
You can use TorDNS as a local DNS server to rectify the DNS leakage. TheOnionRouter/SupportPrograms

See the Torify HOWTO for info on how to run particular applications anonymously.

If you think that you applied one of the solutions properly but still experience DNS leaks please verify there is no third-party application using DNS independently of Tor. Please see the FAQ entry on whether you're really absolutely anonymous using Tor for some examples.

TODO: More detail on solutions.  More windows/unix clarity.  And, of course, somebody should
write a good, working tsocks workalike that also intercepts gethostbyname.
Look into whether dante can intercept gethostbyname.

4.19. How do I check if my application that uses SOCKS is leaking DNS requests?

[link]

These are two steps you need to take here. The first is to make sure that it's using the correct variant of the SOCKS protocol, and the second is to make sure that there aren't other leaks.

Step one: add "TestSocks 1" to your torrc file, and then watch your logs as you use your application. Tor will then log, for each SOCKS connection, whether it was using a 'good' variant or a 'bad' one. (If you want to automatically disable all 'bad' variants, set "SafeSocks 1" in your torrc file.)

Step two: even if your application is using the correct variant of the SOCKS protocol, there is still a risk that it could be leaking DNS queries. This problem happens most commonly in Firefox extensions that resolve the destination hostname themselves, for example to show you its IP address, what country it's in, etc. These applications may use a safe SOCKS variant when actually making connections, but they still do DNS resolves locally. If you suspect your application might behave like this, you should use a network sniffer like wireshark and look for suspicious outbound DNS requests. I'm afraid the details of how to look for these problems are beyond the scope of a FAQ entry though -- find a friend to help if you have problems.

If your application doesn't behave safely, or you're not sure, you may find it simpler to use a Tor package that sets Tor up as a transparent proxy. On Windows these include JanusVM and Xerobank; on Linux and BSD you can set this up with these instructions.

4.20. I try to connect to https://example.com:1234/ through privoxy and it does not work.

[link]

By default privoxy only allows CONNECT (https) to the well known https port 443. If for some reason you try to access an https service on a non-standard port you will need to tell privoxy to allow that.

Edit the default.action file and look for the line that says

-limit-connect \

and replace it with something like this:

+limit-connect{1-} \

and then restart privoxy.

4.21. Fat/Universal Binaries for OSX?

[link]

Yes. OSX bundles since 0.1.2.1-alpha and 0.1.1.24-stable are fat/universal binaries. However, they still contain a ppc-only privoxy.

4.22. Tor/Vidalia prompts for a password at start

[link]

The Vidalia bundle tries to start Tor itself, while setting a random password for the control port of Tor. Vidalia is the GUI that you see in front of you with a network map, message log, and control panel amongst other things. This control port allows Vidalia to control Tor. The random password allows only your Vidalia to control your Tor. There are two common situations where Vidalia will prompt for a password:

Vidalia crashes, but leaves Tor running. What happens here is that Tor continues running with the last known random password. You re-start Vidalia, which generates a new random password, but Vidalia can't talk to Tor, because the random passwords are different. One solution is to go into your process or task manager, and terminate the Tor process. You can then restart Vidalia again, and all will work.
You set Tor to run as a service. When Tor is set to run as a service, it starts up when the system boots up. If you configured Tor to start as a service through Vidalia, a random password was set and saved in Tor. When you reboot, Tor starts up and uses the random password it saved. You login and start up Vidalia. Vidalia attempts to talk to the already running Tor. Vidalia generates a random password, but it is different than the saved password in the Tor service. You need to reconfigure Tor to not be a service. See Tor as a service for more info.

5. Running a Tor relay

[link]

5.1. How do I decide if I should run a relay?

[link]

We're looking for people with reasonably reliable Internet connections, that have at least 20 kilobytes/s each way. If that's you, please consider helping out.

5.2. I'd run a relay, but I don't want to deal with abuse issues.

[link]

Great. That's exactly why we implemented exit policies.

Each Tor relay has an exit policy that specifies what sort of outbound connections he will allow from his relay, and what sort he will refuse. The exit policies are propagated to the client in the directory, so clients will avoid picking exit nodes that would refuse to exit to their intended destination.

By default, your relay allows access to many popular services, but restricts some (such as port 25, see all default restricted ports) due to abuse potential. You can edit your torrc to make your exit policy more or less restrictive. If you want to avoid most if not all abuse potential, set it to "reject *:*". This setting forces a "non-exit" operation. Nobody exits through your node, only direct connections to other nodes will be established.

One good way to minimize abuse complaints in general for exit nodes is to set the reverse DNS of your Tor exit IP to be something like 'tor-exit.yourhost.org' or 'tor-readme.yourhost.org'. You can then place this exit notice html page (live version) on a vhost for that hostname to try to educate people before they run off and harass you or your ISP. This actually does cut down on abuse complaints quite a bit, believe it or not.

5.3. Do I get better anonymity if I run a relay?

[link]

Yes, you do get better anonymity against some attacks.

The simplest example is an attacker who owns a small number of Tor relays. He will see a connection from you, but he won't be able to know whether the connection originated at your computer or was relayed from somebody else.

There are some cases where it doesn't seem to help: if an attacker can watch all of your incoming and outgoing traffic, then it's easy for him to learn which connections were relayed and which started at you. (In this case he still doesn't know your destinations unless he is watching them too, but you're no better off than if you were an ordinary client.)

There are also some downsides to running a Tor relay. First, while we only have a few hundred relays, the fact that you're running one might signal to an attacker that you place a high value on your anonymity. Second, there are some more esoteric attacks that are not as well-understood or well-tested that involve making use of the knowledge that you're running a relay -- for example, an attacker may be able to "observe" whether you're sending traffic even if he can't actually watch your network, by relaying traffic through your Tor relay and noticing changes in traffic timing.

It is an open research question whether the benefits outweigh the risks. A lot of that depends on the attacks you are most worried about. For most users, we think it's a smart move.

5.4. Why doesn't my Windows (or other OS) Tor relay run well?

[link]

Tor relays work best on Linux, FreeBSD 5.x+, OS X Tiger or later, and Windows Server 2003.

You can probably get it working just fine on other operating systems too, but note the following caveats:

Versions of Windows without the word "server" in their name sometimes have problems. This is especially the case for Win98, but it also happens in some cases for XP, especially if you don't have much memory. The problem is that we don't use the networking system calls in a very Windows-like way, so we run out of space in a fixed-size memory space known as the non-page pool, and then everything goes bad. The symptom is an assert error with the message "No buffer space available [WSAENOBUFS ] [10055]".
You can read more here.
Most developers who contribute to Tor work with Unix-like operating systems. It would be great if more people with Windows experience help out, so we can improve Tor's usability and stability in Windows. appreciated to help improve the usability of Tor in Windows.
More esoteric or archaic operating systems, like SunOS 5.9 or Irix64, may have problems with some libevent methods (devpoll, etc), probably due to bugs in libevent. If you experience crashes, try setting the EVENT_NODEVPOLL or equivalent environment variable.

5.5. So I can just configure a nickname and ORPort and join the network?

[link]

Yes. You can join the network and be a useful relay just by configuring your Tor to be a relay and making sure it's reachable from the outside.

30 Seconds to a Tor Relay:

Configure a Nickname:

Nickname ididnteditheconfig

Configure ORPort:

ORPort 9001

Configure ContactInfo:

ContactInfo human@example.com

Start Tor. Watch the log file for a log entry that states:

[notice] router_orport_found_reachable(): Self-testing indicates your ORPort is reachable from the outside. Excellent. Publishing server descriptor.

5.6. I want to upgrade/move my relay. How do I keep the same key?

[link]

When upgrading your Tor relay, or running it on a different computer, the important part is to keep the same nickname (defined in your torrc file) and the same identity key (stored in "keys/secret_id_key" in your DataDirectory).

This means that if you're upgrading your Tor relay and you keep the same torrc and the same DataDirectory, then the upgrade should just work and your relay will keep using the same key. If you need to pick a new DataDirectory, be sure to copy your old keys/secret_id_key over.

5.7. How do I run my Tor relay as an NT service?

[link]

You can run Tor as a service on all versions of Windows except Windows 95/98/ME. This way you can run a Tor relay without needing to always have Vidalia running.

If you've already configured your Tor to be a relay, please note that when you enable Tor as a service, it will use a different DataDirectory, and thus will generate a different key. If you want to keep using the old key, see the Upgrading your Tor relay FAQ entry for how to restore the old identity key.

To install Tor as a service, you can simply run:

tor -install

A service called Tor Win32 Service will be installed and started. This service will also automatically start every time Windows boots, unless you change the Start-up type. An easy way to check the status of Tor, start or stop the service, and change the start-up type is by running services.msc and finding the Tor service in the list of currently installed services.

Optionally, you can specify additional options for the Tor service using the -options argument. For example, if you want Tor to use C:\tor\torrc, instead of the default torrc, and open a control port on port 9051, you would run:

tor -install -options -f C:\torrc ControlPort 9051

If you are running Tor 0.1.1.x, you will need to move your torrc file from "\Documents and Settings\user name\Application Data\Tor" to the same folder as your executable before installing the Tor service.

If you have Tor 0.1.0.12 or later, you can also start or stop the Tor service from the command line by typing:

 tor -service start

 tor -service stop

To remove the Tor service, you can run the following command:

tor -remove

If you are running Tor as a service and you want to uninstall Tor entirely, be sure to run the service removal command (shown above) first before running the uninstaller from "Add/Remove Programs". The uninstaller is currently not capable of removing the active service.

5.8. Can I run a Tor relay from my virtual server account?

[link]

Some ISPs are selling "vserver" accounts that provide what they call a virtual server -- you can't actually interact with the hardware, and they can artificially limit certain resources such as the number of file descriptors you can open at once. Competent vserver admins are able to configure your server to not hit these limits. For example, in SWSoft's Virtuozzo, investigate /proc/user_beancounters. Look for "failcnt" in tcpsndbuf, tcprecvbuf, numothersock, and othersockbuf. Ask for these to be increased accordingly. Some users have seen settings work well as follows:

resource	held	maxheld	barrier	limit	failcnt
tcpsndbuf	46620	48840	3440640	5406720	0
tcprcvbuf	0	2220	3440640	5406720	0
othersockbuf	243516	260072	2252160	4194304	0
numothersock	151	153	720	720	0

Xen and VMWare virtual servers have no such limits normally.

If the vserver admin will not increase system limits another option is to reduce the memory allocated to the send and receive buffers on TCP connections Tor uses. An experimental feature to constrain socket buffers has recently been added. If your version of Tor supports it, set "ConstrainedSockets 1" in your configuration. See the tor man page for additional details about this option.

Unfortunately, since Tor currently requires you to be able to connect to all the other Tor relays, we need you to be able to use at least 1024 file descriptors. This means we can't make use of Tor relays that are crippled in this way.

We hope to fix this in the future, once we know how to build a Tor network with restricted topologies -- that is, where each node connects to only a few other nodes. But this is still a long way off.

5.9. I want to run more than one relay.

[link]

Great. If you want to run several relays to donate more to the network, we're happy with that. But please don't run more than a few dozen on the same network, since part of the goal of the Tor network is dispersal and diversity.

If you do decide to run more than one relay, please set the "MyFamily" config option in the torrc of each relay, listing all the relays (comma-separated) that are under your control:

MyFamily $fingerprint1,$fingerprint2,$fingerprint3

where each fingerprint is the 40 character identity fingerprint (without spaces). You can also list them by nickname, but fingerprint is safer. Be sure to prefix the digest strings with a dollar sign, '$', so that the digest is not confused with a nickname in the config file.

That way clients will know to avoid using more than one of your relays in a single circuit. You should set MyFamily if you have administrative control of the computers or of their network.

5.10. My relay is picking the wrong IP address.

[link]

Tor guesses its IP address by asking the computer for its hostname, and then resolving that hostname. Often people have old entries in their /etc/hosts file that point to old IP addresses.

If that doesn't fix it, you should use the "Address" config option to specify the IP you want it to pick. If your computer is behind a NAT and it only has an internal IP address, see the following FAQ entry on dynamic IP addresses.

Also, if you have many addresses, you might also want to set "OutboundBindAddress" so external connections come from the IP you intend to present to the world.

5.11. I don't have a static IP.

[link]

Tor can handle relays with dynamic IP addressess just fine. Just leave the "Address" line in your torrc blank, and Tor will guess.

Alas, there are bugs with this feature every so often, so if it's not working for you and you can demonstrate it, please help us improve it. You may find the 0.2.0.x version of Tor to be better at guessing than the earlier versions.

5.12. I'm behind a NAT/Firewall

[link]

If your relay is running on a internal net you need to setup port forwarding. Forwarding TCP connections is system dependent but the firewalled-clients FAQ entry offers some examples on how to do this.

Also, here's an example of how you would do this on GNU/Linux if you're using iptables:

/sbin/iptables -A INPUT -i eth0 -p tcp --destination-port 9001 -j ACCEPT

You may have to change "eth0" if you have a different external interface (the one connected to the Internet). Chances are you have only one (except the loopback) so it shouldn't be too hard to figure out.

5.13. My cable modem keeps crashing. What's going on?

[link]

Tor relays hold many connections open at once. This is more intensive use than your cable modem (or other home router) would ever get normally. So if there are any bugs or instabilities, they might show up now.

If your router/etc keeps crashing, you've got two options. First, you should try to upgrade its firmware. If you need tips on how to do this, ask Google or your cable / router provider, or try the Tor IRC channel.

Usually the firmware upgrade will fix it. If it doesn't, you will probably want to get a new (better) router.

5.14. Why do I get portscanned more often when I run a Tor relay?

[link]

If you allow exit connections, some services that people connect to from your relay will connect back to collect more information about you. For example, some IRC servers connect back to your identd port to record which user made the connection. (This doesn't really work for them, because Tor doesn't know this information, but they try anyway.) Also, users exiting from you might attract the attention of other users on the IRC server, website, etc. who want to know more about the host they're