Run a Tor Snowflake proxy on a ProVM

A Snowflake proxy relays connections from Tor users on restricted networks to the Tor network. This guide runs one in Docker on a ProVM, with the Tor Project’s own Compose file.

Snowflake is not a classic Tor bridge with one fixed address for censors to block. Users reach volunteer proxies such as yours through short WebRTC connections, the technology that video calls in a browser use.

Before you start

• A Doprax account with credit.
• A ProVM with Ubuntu. The smallest plan, P1, is enough. See Plans and prices.

Use ProVM, not Hetzner

The proxy receives UDP on a wide range of ports. On a ProVM all ports are open. On a Hetzner VM only TCP ports 80, 443 and 19000 to 19100 can be reached from the internet.

1. Create the VM and connect

Create the VM as described in Create your first virtual machine, with ProVM as the provider and Ubuntu as the operating system. Then connect:

ssh root@YOUR_VM_IP

2. Install Docker

curl -fsSL https://get.docker.com -o get-docker.sh
sh get-docker.sh
docker --version

3. Start the Snowflake proxy

Download the Tor Project’s Compose file and start it:

mkdir snowflake && cd snowflake
curl -fsSL -o docker-compose.yml "https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/snowflake/-/raw/main/docker-compose.yml?ref_type=heads"
docker compose up -d

This starts two containers:

• snowflake-proxy, the proxy itself.
• watchtower, which checks for a new version of the proxy and installs it.

The commands are from the Tor Project’s Docker setup guide for a standalone Snowflake proxy.

4. Confirm that it is running

docker ps
docker logs -f snowflake-proxy

docker ps must list snowflake-proxy with the status Up. The log shows the proxy starting. After that it writes a summary at intervals: how many connections it relayed and how much traffic passed through. Leave the log with Ctrl+C; the proxy keeps running.

A new proxy can wait some time for its first users.

5. Check the UDP ports

The Compose file gives the proxy the VM’s network directly. The proxy receives UDP on the range of ports that this command prints:

cat /proc/sys/net/ipv4/ip_local_port_range

The usual answer is 32768 60999.

• On the Doprax side there is nothing to open. On a ProVM every port can be reached from the internet, and the dashboard has no firewall setting.

• Inside the VM, check whether a firewall is on:

  ufw status

  If it says Status: inactive, nothing is blocked. If it is active, allow the range that the first command printed:

  ufw allow 32768:60999/udp

6. Keep it running after a reboot

There is nothing to add. The Compose file sets restart: unless-stopped for the proxy, so Docker starts it again when the VM boots. You can check that the line is there:

grep restart docker-compose.yml

After a reboot of the VM, docker ps should list snowflake-proxy again.

Good to know

• To stop the proxy, run docker compose down in the snowflake folder.
• A stopped VM is charged at its full price. To stop paying, delete the VM.