diff --git a/flake.nix b/flake.nix
index 47db5f6..59b8b21 100644
--- a/flake.nix
+++ b/flake.nix
@@ -44,6 +44,7 @@
           ./modules/services/openssh.nix
           ./modules/services/firewall.nix
           ./modules/services/tailscale.nix
+          ./modules/services/tor-bridge.nix
           ./modules/services/podman.nix
           ./modules/services/static-sites
           ./modules/users/tobias.nix
diff --git a/modules/services/firewall.nix b/modules/services/firewall.nix
index 2418b99..b3e16e2 100644
--- a/modules/services/firewall.nix
+++ b/modules/services/firewall.nix
@@ -1,5 +1,5 @@
 { ... }:
 {
   networking.firewall.enable = true;
-  networking.firewall.allowedTCPPorts = [ 22 80 443 8443 ];
+  networking.firewall.allowedTCPPorts = [ 22 80 443 4430 8443 ];
 }
diff --git a/modules/services/tor-bridge.nix b/modules/services/tor-bridge.nix
new file mode 100644
index 0000000..6e80033
--- /dev/null
+++ b/modules/services/tor-bridge.nix
@@ -0,0 +1,15 @@
+{ pkgs, ... }: {
+  services.tor = {
+    enable = true;
+    relay = {
+      enable = true;
+      role = "bridge";
+    };
+    settings = {
+      ServerTransportPlugin = "obfs4 exec ${pkgs.obfs4}/bin/obfs4proxy";
+      ServerTransportListenAddr = "obfs4 0.0.0.0:4430";
+      ExtORPort = "auto";
+      BridgeDistribution = "none";
+    };
+  };
+}