Tor Bridge Hosting — Obfs4 on Your Own VPS

A bridge is Tor's unlisted front door: what it does that relays and exits do not, how to run obfs4 on a KVM, and what distribution costs. From $4.80/mo.

Published 2026-10-04 · Updated 2026-10-06 · VPSbit Editorial

12 locations · 19 coins · SLA 99.95% · no KYC · public canary

The short answer

Short answer: a bridge is an unlisted Tor entry point — it moves clients into the network without appearing in the public directory, which is where relays and exits are published. Hosting one obfs4 bridge costs Core money ($4.80/mo annual-eff), roughly twenty minutes of setup, and one real decision: private or public distribution. Bridges are ordinary workloads here — Tor is welcome on every plan; relays and exits additionally go through a ticket so the abuse desk knows what the IP carries.

Bridge, relay, exit — the actual differences

The tier follows from the role. A bridge hides the fact that it is Tor at all; a middle relay strengthens the network publicly without touching the censorship-sensitive end; an exit puts your rack IP on every destination site's logs and needs the operational maturity of a read abuse inbox. The exit-relay page covers that end; the Iceland relay setup and the Netherlands relay setup show the rack-side details.

Running obfs4, step by step

The whole run fits one SSH session on Debian 12:

1. Order a KVM with Debian 12. Core — 2 vCPU / 4 GB DDR5 / 80 GB NVMe — carries a private bridge with headroom; Amsterdam or Frankfurt for EU latency, Reykjavik when jurisdiction is the reason.
2. Install from the Debian repositories: apt install tor obfs4proxy. No third-party scripts or packages are required.
3. In torrc set BridgeRelay 1 and ServerTransportPlugin obfs4 exec /usr/bin/obfs4proxy, let ORPort auto-assign, and restart tor — the bridge line lands in the log.
4. Allow the ORPort and the obfs4 listen port in the firewall, then copy the full obfs4 line — cert and iat-mode included — from /var/log/tor/log.
5. Hand the line to the people who need it. Public distribution invites scanning and faster blocking; private sharing survives longer.

What it costs and where it hurts

Core at $4.80/mo annual-eff is the entire bill; a private bridge sits orders of magnitude below the 1 Gbps unmetered port, so bandwidth is never the topic. The honest cost is distribution. A publicly submitted bridge gets enumerated and blocked by censors faster than a private one; a private bridge makes you the distribution channel — lose the bridge line and you have lost the entry. For censored users without a server at all, Snowflake covers the bootstrapping case instead.

Two rack notes: the bridge's MetricsPort statistics stay on your disk under your control, and the published privacy posture applies as everywhere — no traffic logs (connection metadata ages out inside 24 h). If the account should not touch a mailbox at all, token signup handles it; the anonymous VPS guide covers the account layer.