Running a Snowflake Proxy

Snowflake is a WebRTC-based pluggable transport. Censored users connect via WebRTC to Snowflake proxies (volunteers who share their network as a relay). The proxy receives the WebRTC connection and forwards it to a Snowflake broker, which connects the user to a Tor relay. The key insight: the censored user's connection goes to the Snowflake proxy (which is running anywhere in the world), not directly to a Tor relay. The Tor relay IP is never visible to the censored user's ISP. From the ISP's perspective: the censored user is making a WebRTC connection (like video conferencing) to the Snowflake proxy IP. The Snowflake proxy is just another internet IP - it is not in any blocklist until it is specifically identified as a Snowflake proxy. The decentralized nature of Snowflake proxies (thousands of volunteers) makes comprehensive blocking nearly impossible.

The simplest Snowflake proxy method: install the Snowflake browser extension for Firefox (addons.mozilla.org, search 'Snowflake') or Chrome/Chromium (Chrome Web Store, search 'Snowflake'). After installation, enable the extension. When your browser is running, the extension accepts Snowflake connections from censored users and relays them to Tor. The extension uses WebRTC (the same technology as video calls) to receive and forward traffic. Resource usage: minimal. The extension uses a small amount of CPU and network bandwidth when active connections are being relayed. Your IP address is temporarily exposed to the Snowflake user (they connect directly via WebRTC). Note: this is the user's traffic being relayed - you are not an exit node and cannot see the traffic's content (it is encrypted Tor traffic). Your IP may appear in the destination as a Tor-adjacent address but does not expose you to legal risk for traffic content.

For dedicated Snowflake proxy operation without a browser: use the snowflake-proxy standalone binary. Download from the Tor Project's GitLab or build from source. Run: ./snowflake-proxy -ephemeral-ports-range 1-65535 -capacity 3 (allows up to 3 simultaneous users). Standalone operation provides more consistent availability than browser extension (the browser extension only runs when the browser is open). Run as a systemd service for 24/7 operation. The standalone proxy is appropriate for: a desktop or laptop that runs continuously, a Raspberry Pi or similar always-on device, or a VPS with spare bandwidth. A Romania VPS Mini at $19.99/mo with its bandwidth allocation can run a Snowflake proxy serving multiple simultaneous users continuously. Unlike running a full Tor bridge (which requires port forwarding and server configuration), a standalone Snowflake proxy makes outbound connections only - easier to run behind NAT or shared networks.

For maximum impact: deploy a dedicated Snowflake proxy server on a VPS. Advantages over desktop-based proxy: 24/7 operation, consistent bandwidth, public IP (better connectivity than NAT-based proxies). A VPS in Iceland or Romania provides: stable IP, good European bandwidth, and proximity to major internet exchange points. Setup: clone the Snowflake repository (gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snowflake), build the snowflake-proxy binary (requires Go), and create a systemd service. Resource requirements: 256 MB RAM (extremely lightweight), 1 CPU, and bandwidth proportional to usage (each user consumes 500 KB/s - 2 MB/s). A Romania VPS Mini serves 5-10 simultaneous Snowflake users comfortably within normal bandwidth allocations. The Snowflake proxy does not need a public port open - it makes outbound WebRTC connections.

Running a Snowflake proxy forwards encrypted Tor traffic - you cannot see the content of the traffic being relayed. Your IP address appears as the origin of the WebRTC connection, but the Tor traffic is encrypted multiple times within the WebRTC tunnel. Legal consideration: you are running a relay for encrypted traffic (similar to being an internet relay in terms of legal exposure). The Tor Project provides a legal FAQ for relay operators. In most Western jurisdictions, running a relay for encrypted traffic is not a criminal act. The Electronic Frontier Foundation has published guidance on relay operators' legal protections. For maximum clarity about your operation: keep logs minimal (default Snowflake proxy logs are minimal), note that you run a Snowflake proxy for Tor censorship circumvention if ever questioned, and contact the Tor Project or EFF for guidance if you receive any inquiries.