Tor Bridge on Raspberry Pi: Home Server Configuration Guide

Censors can block entire data center IP ranges (AWS, GCP, Azure, Hetzner, OVH ranges) without significantly impacting legitimate residential traffic. Home bridge IP addresses (from ISPs like Comcast, Deutsche Telekom, or regional broadband providers) are much harder to block because blocking them would also block traffic from ordinary internet users. A home bridge running on Raspberry Pi uses a residential ISP IP, making it significantly harder for censors to enumerate and block versus VPS-hosted bridges. The Snowflake project is based on this principle at scale - volunteers run proxies from home browsers to serve as entry points with residential IPs.

Raspberry Pi 4 Model B (4GB RAM) or Raspberry Pi 5 are recommended. Raspberry Pi 3 works but is underpowered for sustained obfs4 bridge operation at higher capacities. Required: a microSD card (32GB+, Class 10 or better), a reliable USB-C power supply (official Raspberry Pi power supply recommended), and reliable internet connection (100 Mbps+ upstream for a useful bridge). Optional but recommended: case with active cooling for sustained operation, and UPS backup power to handle brief power outages.

Install Raspberry Pi OS Lite (64-bit for Pi 4/5) from the official imager. Enable SSH for remote management. Update packages: apt update && apt upgrade. Install Tor: add the Tor Project's APT repository for the latest version (do not use the older version in the Raspberry Pi repo), then apt install tor. Install obfs4proxy: apt install obfs4proxy. Configure /etc/tor/torrc with bridge configuration: ORPort 9001, ServerTransportPlugin obfs4 exec /usr/bin/obfs4proxy, ServerTransportListenAddr obfs4 0.0.0.0:9050, ExtORPort auto, BridgeRelay 1. Reload Tor and verify the bridge is operational through the logs and metrics.torproject.org/rs after a few hours.

Home ISP connections typically have dynamic IP addresses that change periodically. Bridge clients configured with a specific IP will lose connection when the IP changes. Solutions: (1) Set up a dynamic DNS service (No-IP, DuckDNS) that updates when your IP changes, and configure clients to use the hostname instead of IP. obfs4 supports domain names in bridge addresses. (2) Request a static IP from your ISP (often available for a monthly fee). (3) Accept IP changes and distribute new bridge addresses to your community when they change - feasible for small communities with direct communication. (4) Submit to BridgeDB (which handles IP changes in bridge descriptors automatically as your bridge re-publishes its descriptor).

A Raspberry Pi 4 consumes approximately 5-15W while running a bridge. At $0.10/kWh, this costs approximately $0.01-0.03/day - effectively free to operate. More significant is ensuring continuous operation: power outages, ISP maintenance, and hardware failures interrupt bridge availability. A UPS (uninterruptible power supply) handles brief outages. The Raspberry Pi's SD card degrades over time with frequent writes - use a high-quality endurance SD card or (better) boot from an external SSD via USB. Monitor uptime and bridge availability through the Tor metrics. A home bridge contributing to BridgeDB should maintain 95%+ uptime to be reliably useful.