How to Run a Tor Exit Node Without Surprises

Wetin Tor exit node dey do, and who e make you

Tor exit node na the last relay for one circuit: na the machine wey open connection go the destination. So, destination go log your server address, and e no go ever see the user's address. Every other decision for this guide come from this fact. Dem treat the address as the source of everything wey pass through am. So, e must be an address wey no dey do any other work, for provider wey agree to carry this traffic.

To run an exit node no be to hide yourself. Dem list the relay for public directory wey anybody fit download. Your contact address dey for that directory under ContactInfo. Your reverse DNS (domain name system) name dey announce wetin the box be. Port 80 dey serve page wey talk the same thing. You go answer abuse mail yourself, under your own name. Nobody for this system dey more identifiable than exit operator. Na the work be that, and na why the work dey function.

We dey run these ones. SSD Nodes dey operate exit relays for several countries as our contribution to free expression. We rent those machines from providers wey deliberately sign up for exit traffic, and we no be their provider. Na so we plan am, and the next section go explain why.

Wetin be the proper place for exit, and wetin no be

Exit no belong for general-purpose VPS (virtual private server), and our own one sef dey include. General-purpose network dey carry websites, mail, backups and control panels for thousands of unrelated customers wey dey use nearby addresses. Exit traffic fit put one of those addresses for scanning reports and spam blocklists, and the effects go reach the neighbours. Providers wey dey host exits well don build their setup for am: dem set aside address space for this purpose, and dem get abuse desk wey already sabi wetin Tor be.

So, when host wey dey write this guide dey tell you make you buy the machine somewhere else, na that be the useful part. We know wetin exit traffic dey do to an address because we dey pay other people to carry our own, and we dey pay dem because to carry am properly na different business from selling general-purpose servers.

The Tor Project talk the same thing for more direct terms. E types of relays page talk say exit relays "get the highest legal exposure and liability among all the relays" and say "you no suppose run Tor exit relay from your house". General-purpose VPS wey dey host your own projects dey closer to house than e look. Na machine wey matter to you, for address wey you want keep clean.

If you get ordinary VPS and you want help the network this week, run non-exit relay or bridge for am. This no be consolation prize. Na different work with different risk profile, and network need both. Non-exit relay no ever open connection to destination, so e dey bring almost no complaints, and Tor guidance ask for at least 2 MByte/s (megabytes per second) for each direction before e make sense to list am. A bridge na entry point wey no dey listed for users wey dey censored networks. E need 24/7 connectivity and one open TCP (transmission control protocol) port, so e be the most valuable thing wey small box fit do. Both of dem belong on hardware wey you already get. Exit no belong there.

How you go find provider wey fit handle exit well?

Ask before you order, for writing, and keep the reply. Tor exit guidelines suggest make you ask for two steps: first, whether the provider dey okay with Tor exit at all, then whether dem go assign dedicated address or range for am. If you ask both together, dem fit just give reflexive no.

Four questions fit show whether provider really set up for this work.

• You go assign dedicated IP address wey no dey host anything else, and you go set the reverse DNS record wey I request?
• Who dey receive the abuse mail, and you go forward am to me without editing, with the reporter's address intact so I fit reply dem directly?
• Wetin go happen for the first complaint: you go forward am to me, or you go null-route the address first and ask later?
• How many exits already dey for this network? Tor's guidelines talk am clearly: "it does not help if we pool too many exits in one friendly ISP".

That last question important pass as e first look. Part of exit value come from where e dey for the network. Another exit for network wey already get fifty of dem add less value than the same machine for somewhere new. Relay Search show which networks already carry exits, so you fit check before you commit.

Get the answers before you pay, and buy the machine with its own account instead of adding am to the account wey hold your other servers. How safe VPS hosting dey depend mostly on wetin you place beside wetin, and this na the clearest example of that rule.

One address, one job

The exit address no suppose host anything else. No website, no mail, no VPN, no monitoring dashboard, no personal SSH (secure shell) jump host. Blocklist go catch the address, and anything else wey dey there go start fail for ways wey hard to debug. Single-purpose address also make your answer to complaints short: this address na exit relay, nothing else dey there.

Before tor go run, do the normal work. Use key-only SSH and disable password login. Configure firewall make e allow only the ports wey you dey publish. SSH hardening for VPS cover the first part, while ufw firewall basics cover the second. Exit go publish exactly two ports to the world: ORPort wey carry Tor traffic, and port 80 for the exit notice page. Keep every other port closed.

Turn on unattended upgrades, because exit wey dey run old tor build na problem for every user wey route traffic through am.

sudo apt update && sudo apt install -y unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades

No add logging. Capturing the plaintext wey leaves exit technically easy, but na the one thing operator must never do. The EFF Tor legal FAQ tell operators make dem no do am, because wiretap law for United States and similar law for other places fit create liability if person examine that traffic. Keep tor default notice-level logging and nothing more.

Install tor from the Tor Project repository

Distribution packages dey lag. Use Tor Project own repository so security fixes fit arrive the same day wey dem release am. As of August 2026, the current stable series na 0.4.9.

sudo apt update
sudo apt install -y apt-transport-https gnupg wget
lsb_release -cs

Write /etc/apt/sources.list.d/tor.sources, replace noble with the codename wey lsb_release -cs print:

Types: deb deb-src
URIs: https://deb.torproject.org/torproject.org/
Suites: noble
Components: main
Signed-By: /usr/share/keyrings/deb.torproject.org-keyring.gpg

Add the signing key, then install:

wget -qO- https://deb.torproject.org/torproject.org/A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc | gpg --dearmor | sudo tee /usr/share/keyrings/deb.torproject.org-keyring.gpg >/dev/null
sudo apt update
sudo apt install -y tor deb.torproject.org-keyring
tor --version

The deb.torproject.org-keyring package dey keep that key current by itself, so the repository no go break the day the key change. If apt update report say the same repository dey configured twice, you get both a .list file and a .sources file wey name am, and the deb822 duplicate source error explain how to clear am.

DNS: your exit dey resolve names for everybody wey dey use am

Exit dey do name lookup for every circuit wey dey pass through am, so e resolver dey see stream of names wey belong to other people. If you point am to one big public resolver, you don hand the whole stream to one company. Na the centralisation wey Tor dey ask exit operators to avoid be that. Run validating, caching resolver for the box instead.

sudo apt install -y unbound bind9-dnsutils
sudo cp /etc/resolv.conf /etc/resolv.conf.backup
echo "nameserver 127.0.0.1" | sudo tee /etc/resolv.conf
sudo chattr +i /etc/resolv.conf
sudo systemctl enable --now unbound

chattr +i dey mark the file as immutable, because DHCP (dynamic host configuration protocol) clients and resolvconf dey rewrite /etc/resolv.conf according to their own schedule. Without am, reboot fit move your lookups back to the provider's resolver, and nothing go warn you when e happen. Tor Debian and Ubuntu instructions also enable query name minimisation. This one sends each name server only the part of the name wey e really need:

server:
    qname-minimisation: yes

Put am for one file under /etc/unbound/unbound.conf.d/, then confirm say resolver dey answer:

sudo systemctl restart unbound
dig +short example.com @127.0.0.1

Address for the reply mean say unbound dey work. If unbound no start with address already in use, another process dey hold port 53. Run sudo ss -lntup | grep :53 and check wetin dey own am. For Ubuntu, systemd-resolved dey listen on 127.0.0.53, so e no dey collide with unbound on 127.0.0.1.

The torrc for an exit relay

Debian package dey read /etc/tor/torrc. Na the complete configuration wey concern exit relay.

Nickname     exampleExit01
ORPort       443
ExitRelay    1
SocksPort    0
ContactInfo  email:tor[]example.org abuse:abuse[]example.org url:https://example.org ciissversion:3
ReducedExitPolicy 1
Log          notice syslog

Every line for there important, so make you take dem one by one.

ORPort 443 na where other relays dey connect to you. Port 443 dey pass through restrictive networks wey block unusual ports, so more people fit reach your relay than if e dey use the traditional 9001. You fit only claim 443 because nothing else for this box need am. This na another reason to use dedicated address.

SocksPort 0 dey turn off the local SOCKS proxy. Relay no ever need am. SOCKS port wey dey listen on public address na open proxy, and people go find and abuse am within hours.

ExitRelay 1 na the switch wey make this one exit relay. Set am explicitly instead of depending on default, so config file go clearly state wetin the machine dey do.

ContactInfo dey published for public directory make anybody read am. Write am with ContactInfo Information Sharing Specification format, because na the network tooling dey parse. Make sure say ciissversion:3 dey inside am. The [] instead of @ na the convention wey the specification use to slow down address scrapers. Use mailbox wey you dey read every day, because na there abuse mail go land.

If the box get working IPv6, add IPv6 ORPort and enable IPv6 exiting. Leave both out if e no get am, because relay wey advertise address wey e no fit actually use go fail its own reachability test.

ORPort   [2001:db8::1]:443
IPv6Exit 1

Exit policy: wetin each port dey allow

Exit policy na list of destinations wey your relay dey willing to connect to. Tor dey read am from top go bottom, and the first rule wey match go win. ReducedExitPolicy 1 dey select a carefully chosen list of about seventy ports wey cover web, mail submission, chat, and git. E leave out the ports wey dey cause most complaints. Na correct starting point for first exit relay.

Two rules dey important to know by name. ExitPolicyRejectPrivate dey enabled by default. E stop the exit from connecting to private address ranges and the relay own addresses. Na this one dey prevent people from directing your exit to your provider internal network. Port 25 (SMTP, simple mail transfer protocol) dey rejected and make e remain rejected, because if you allow am, the relay fit become spam source and dem fit blocklist the address within days.

Exit must allow ports 80 and 443 before e fit useful at all. Tor exit relay documentation talk this minimum directly. If your provider want policy wey tighter pass the reduced policy, web-only exit still be useful contribution:

ExitPolicy accept *:80
ExitPolicy accept *:443
ExitPolicy reject *:*

End the list with reject *:* so your policy complete by itself and nothing else go inherit. The reduced policy dey allow port 22 (SSH), and na this port usually dey cause brute-force reports. So add ExitPolicy reject *:22 above the other rules if you no wan handle that kind mail. File-sharing ports for the 6881-6999 range dey usually cause copyright notices, and the reduced policy don already exclude dem.

Policy change go reach clients only after your relay publish new descriptor and directory propagate am. So wait some hours before you judge the effect.

ContactInfo, family keys, and registering the relay

To register an exit, you need tie am to one name wey stranger fit verify. Two mechanisms dey do this, and dem dey work together.

The first one na a well-known file. Publish your family identity for domain wey you control, then name that proof inside ContactInfo:

ContactInfo email:tor[]example.org url:https://example.org proof:uri-familyid-ed25519 ciissversion:3

The file dey for https://example.org/.well-known/tor-relay/ed25519-family-id.txt and e contain your family ID. Anybody fit now confirm say whoever claim these relays also control that domain. Na this one separate contact address from verified contact address.

The second one na the family itself. If you run more than one relay, the network need know say one operator dey behind dem, so client no go ever build circuit through two of your machines. Current tor dey do this with family key, wey dem call Happy Families, for relays wey dey run 0.4.9.2-alpha or later:

tor --keygen-family exampleFamily

That command dey write exampleFamily.secret_family_key and print one FamilyId line. Copy the secret key file go each relay key directory (/var/lib/tor/keys for Debian and Ubuntu), keep the .secret_family_key ending for the filename, add the printed FamilyId line to each torrc, then reload tor. Tor documentation talk clearly say you still must set the legacy MyFamily option wey list every relay fingerprint until the project announce say e no longer necessary, so configure both. Each relay fingerprint dey inside /var/lib/tor/fingerprint.

Na for the second and third machine operations begin to matter, and manage several Linux servers at once na the same problem here like everywhere else. Back up /var/lib/tor/keys somewhere outside the server. If you lose am, the relay go return as stranger, and e go need earn every flag plus all its reputation again from zero.

Subscribe to the tor-relays mailing list too. Dem dey announce changes wey affect operators there first.

Reverse DNS wey notice for port 80

Set reverse DNS record before relay carry any traffic. Tor exit guidelines talk say make e show wetin the box be, something like tor-exit-01.example.org. The reason na practical. When unfamiliar address show for person log, the first thing dia admin go run na reverse lookup. Name wey contain "tor-exit" go answer the question before anybody write you, so some possible complaints no go happen at all. Ask provider make dem set PTR (pointer) record, and add matching forward record for your side.

Then serve notice page for port 80 wey talk the same thing with words. Older guides dey do this with tor DirPortFrontPage setting, wey depend on DirPort. Dem don deprecate DirPort for relays since tor 0.4.6.5, so use small web server instead.

sudo apt install -y nginx
sudo install -d -m 755 /srv/tor-exit-notice

Write /srv/tor-exit-notice/index.html:

<!DOCTYPE html>
<html>
<head><title>This is a Tor exit relay</title></head>
<body>
<h1>This is a Tor exit relay</h1>
<p>Traffic from this address was sent by a user of the Tor network. It did not
come from the operator of this machine, and this machine keeps no record of
who sent it.</p>
<p>Operator: Example Org. Abuse reports: abuse@example.org. Every report gets a
reply from a person.</p>
<p>To check whether this address was a Tor exit at a given date and time:
https://metrics.torproject.org/exonerator.html</p>
</body>
</html>

Write this server block to /etc/nginx/sites-available/tor-exit-notice:

server {
    listen 80 default_server;
    listen [::]:80 default_server;
    server_name _;
    root /srv/tor-exit-notice;
    index index.html;
    access_log off;
}

Enable am, remove nginx default site, and check the result:

sudo ln -sf /etc/nginx/sites-available/tor-exit-notice /etc/nginx/sites-enabled/tor-exit-notice
sudo rm -f /etc/nginx/sites-enabled/default
sudo nginx -t && sudo systemctl reload nginx
curl -s http://127.0.0.1/ | head -n 5

nginx -t reporting syntax is ok and test is successful mean say the file parse correctly. curl suppose print the first lines of your notice. If e print nginx welcome page instead, default site still dey enabled and dem no dey use your block.

Start am, then read wetin the log talk

sudo systemctl restart tor@default
sudo journalctl -u tor@default -n 50 --no-pager

Within some minutes, the log suppose show the line wey mean say other relays fit reach you:

Self-testing indicates your ORPort is reachable from the outside. Excellent.

If that line no show at all, e mean say dem no fit reach the ORPort. Confirm say tor dey listen with sudo ss -lntp | grep 443, then test the port from another machine with nc -vz your.address.here 443. Firewall wey dey before the VPS, whether na your own or one for the provider's control panel, na the usual cause.

Check say the service go return after reboot with systemctl is-enabled tor. E suppose print enabled.

The relay go show for Relay Search around three hours after e start, under the nickname wey you choose. Traffic go then increase over several days, because the network bandwidth measurement need observe your relay before clients go give am much weight. New exit wey dey carry almost no traffic for day one na normal.

Abuse playbook, and wetin di mail dey look like

Write di playbook before di first complaint, because di first one normally go land within di first week. Most of dis mail na machine-generated. Tor exit guidelines talk say automated reports dey around 80% of di total, and standard reply dey settle most of wetin remain.

Na so di mail wey go actually land dey look. Somebody intrusion detection system fit produce scanning or brute-force report, quote your address and timestamp. Copyright notice fit land, if your policy allow file-sharing ports. Site owner fit complain about forum or comment spam. Sometimes, law enforcement fit send preservation request or subpoena. Dis one na different category, and na the point wey you go talk to lawyer instead of using template.

Di reply short, and e nearly dey same every time:

Hello,

Thank you for the report. The address 203.0.113.10 is a Tor exit relay,
operated by <your name> at <your organisation>. The connection you saw was
made by a user of the Tor network. It did not originate on this machine.

This relay keeps no record of which user made which connection, so I cannot
identify the sender and there are no logs for me to hand over.

You can confirm that this address was a Tor exit at the date and time in
question here: https://metrics.torproject.org/exonerator.html

If you would prefer to stop Tor traffic reaching your service, the current
list of exit addresses is published here:
https://check.torproject.org/torbulkexitlist

I read this mailbox personally and will answer any follow-up.

<your name>

Four habits dey make dis work. Reply within one working day, from di address for ContactInfo, and sign am with your own name. Never promise to identify user, because you no fit do am. If operator imply say e fit, e go later need break dat promise. Keep every reply for one folder, so if second mail come about di same incident, e go get di same answer. If provider forward complaint with suspension warning attached, answer di provider first, then answer di reporter.

Two links dey carry most of di weight for those replies. ExoneraTor answer di question wey investigator really get: whether dis address be Tor exit at dat moment. Di bulk exit list na plain list of current exit addresses, one per line, for anybody wey decide to block Tor and prefer accurate blocking instead of guessing.

Bandwidth, cost, and the second relay

Exits dey move real traffic. Decide the monthly limit before you order, and ask how the provider dey charge after you use the allowance finish, because wetin VPS really cost mostly depend on the transfer allowance, no be the displayed price. Tor fit enforce your own limit:

AccountingMax 4 TBytes
AccountingStart month 1 00:00
RelayBandwidthRate 20 MBytes
RelayBandwidthBurst 25 MBytes

AccountingMax go make tor hibernate once e don move that volume for the accounting period, then wake when the next one start. Compare the first month with the provider own counter before you trust the number, because the two counters no always count the same bytes. RelayBandwidthRate limit the sustained rate, and na this one dey keep the uplink usable and the provider calm.

When you add a second exit, put am for another network instead of the same rack with the first one. Diversity na important part of wetin exit dey provide, and two machines for one place fit fail together. Join both of dem to one family, publish the same verified contact for both, and answer mail from both. If nobody fit reach an exit, dem go treat am like anonymous problem. If the operator reply the same day, dem go treat the exit like server wey person dey manage, because na exactly wetin e be.

FAQ

I fit run Tor exit node for VPS wey I already get?

No, and na here you must strict. Exit node need dedicated address wey no dey host anything else, for provider wey don agree before to carry exit traffic and forward abuse mail give you without editing am. For general-purpose VPS, including our own, that address dey do another work already and e dey share neighbourhood with customers wey dey run ordinary services. Run non-exit relay or obfs4 bridge for the machine wey you get. Dem useful well-well, dem dey attract almost no complaints, and dem need only the box wey you already dey pay for.

How much abuse mail Tor exit relay dey receive, and who dey receive am?

E depend on your exit policy. With ReducedExitPolicy 1, port 25 rejected and file-sharing ports excluded, most of wetin arrive na automated scanning and brute-force reports. Tor exit guidelines talk say automated reports dey around 80% of the total. The mail go reach whoever provider abuse desk forward am to. Na why you ask before ordering whether dem go forward am give you with reporter address intact. Publish the same address for ContactInfo and for port 80 notice page, then answer within one working day.

I must publish my real name and email address?

Yes. ContactInfo dey published for public relay directory, and anybody fit download am. The reverse DNS name dey announce wetin the machine be, and notice page for port 80 repeat am. That transparency na the design; e no be side effect. Exit wey no get working contact dem dey treat as anonymous nuisance, and some clients exclude exits wey publish no contact at all. Add proof:uri-familyid-ed25519 and the /.well-known/tor-relay/ed25519-family-id.txt file for domain wey you control, so the contact fit verify instead of just being stated.

Why my new exit relay dey carry almost no traffic?

First check say journalctl -u tor@default contain Self-testing indicates your ORPort is reachable from the outside. Excellent., because relay wey fail reachability test no go ever get published and e no go carry any traffic at all. If that line dey present, answer usually na time. Relay dey appear for Relay Search around three hours after startup, and clients no go send meaningful traffic to am until network bandwidth measurement don observe am. This fit take days. Policy wey allow ports 80 and 443 also dey required before dem go treat your relay as exit at all.