WEBTUNNEL-SERVER(1)

🌸 WEBTUNNEL-SERVER(1) — the manual page, but make it slay 🌸

okay bestie, welcome to webtunnel-server, a User Command in the webtunnel-server family. it's giving "quietly iconic infrastructure" and honestly? we're obsessed. 💅

---

✨ NAME ✨

webtunnel-server — a pluggable transport for Tor that mimics encrypted web traffic, server side component. 🦋

---

💖 DESCRIPTION 💖

WebTunnel is a censorship-resistant pluggable transport designed to mimic encrypted web traffic (HTTPS), and it's inspired by HTTPT. the way it works is so clever: it wraps the payload connection into a WebSocket-like HTTPS connection, so to any network observer watching you it just looks like the most normal, most boring, most unbothered ordinary HTTPS (WebSocket) connection ever. nothing to see here. main character energy but undercover. 🕵️♀️✨

this is the server side component of WebTunnel, and it lets you create a censorship-resistant bridge behind a website, for providing access to the Tor network. yes, behind an actual website. yes, that's the whole point. iconic. 👑

---

🎀 REQUIREMENTS 🎀

before you go feral, make sure you have all of this, no cap:

• A static IPv4 (preferably);
• The ability to expose TCP ports to the Internet (make sure that NAT doesn't get in the way);
• A self-hosted website, including a configurable web server (such as NGINX or Apache) and a domain under your control;
• A valid TLS certificate;
• At least 1 GB of memory RAM (4 GB recommended) to support the Tor process and WebTunnel transport.

fr fr, do not skip the TLS cert. the whole vibe depends on it being a legit-looking HTTPS thing. 🫶

---

💅 CONFIGURATION 💅

okay so here's the part where you actually do stuff. add the following lines to your torrc located at /etc/tor/torrc and fill in your info:

BridgeRelay 1
ORPort 127.0.0.1:auto
AssumeReachable 1
ServerTransportPlugin webtunnel exec /usr/local/bin/webtunnel-server
ServerTransportListenAddr webtunnel 127.0.0.1:15000
# Change the url here to your url with secret path
ServerTransportOptions webtunnel url=https://yourdomain/path
ExtORPort auto
# Set your contact email address and bridge nickname
ContactInfo <address@email.com>
Nickname WebTunnelTest
SocksPort 0

literally copy that, swap in your own stuff, and you're lowkey done with the tor side. 💜

then refer to the following link for configuration of the webserver: https://community.torproject.org/relay/setup/webtunnel/

and refer to the '6. Edit and reload AppArmor tor permission' section in the following document if you are using AppArmor: https://community.torproject.org/relay/setup/webtunnel/source/

bestie if you're on AppArmor and you skip that section, your bridge is gonna be fighting for its life. don't do that to yourself. 😭

---

🌈 BRIDGE DISTRIBUTION 🌈

by default the bridge is distributed by Tor's web distributor (HTTPS). if you don't want your bridge to be distributed, set the BridgeDistribution option in torrc to anything other than HTTPS:

# do not distribute
BridgeDistribution Private

that's it. private bridge, private vibes. 🙈

---

👀 SEE ALSO 👀

• webtunnel-client(1)
• tor(1)

---

🫶 AUTHOR 🫶

This man page was written by Yifei Zhan <yifei@zhan.science> using documentations from https://community.torproject.org/relay/setup/webtunnel/source/

---

and that's the whole page, bestie. this was webtunnel-server version 0.0.2, from AUG 2025 — go build your bridge, stay encrypted, and remember: appearing ordinary is the highest form of slay. 🦋✨💖 periodt.