How to Create a Tor Exit Node

This will beryllium a speedy tutorial connected really to configure an Exit Node for the Tor Network. Doing this comes pinch immoderate inherent risks for the usability but exit nodes are basal for bridging Tor pinch the ‘clear net’. Without exit nodes, anyone suffering from ISP filtering aliases those not wishing to person their Internet activity logged (BBC Article) couldn’t utilise Tor to entree the Internet.

Unlike bridges, exit nodes (and normal relays) are publically known devices, for which their IP address and configuration is available for anyone to see. They efficaciously make the last relationship to the destination connected behalf of the originating (anonymous) client. The Tor web is drastically short of exit nodes, but for bully reason. Because they are the last hop successful the chain, they will beryllium making hundreds of outbound connections to immoderate website aliases work Tor users request. It is truthful easy for the powers who be to blasted an exit node usability for ‘doing bad things’ erstwhile successful truth their node is simply participating successful a network, overmuch for illustration a accepted router would successful immoderate network. Anyway, assuming you person balls of alloy and consenting to tally an exit node I’ll return a look astatine really to do this pinch slightest hassle arsenic possible.

Before we begin, fto maine make it clear moving this from location is perchance dangerous, owed to harassment from ISPs and the powers that be. Although you are not breaking immoderate rule by doing this you are acting arsenic the exit constituent for Tor postulation and you person nary power complete what immoderate of the 2.5 cardinal Tor users crossed the world are going to beryllium doing. If you do experience harassment, enactment calm and cognize you person done thing wrong. There is tons of accusation retired location to thief you if required.

Another rumor you whitethorn look is 1 of reputation. Some websites artifact exit nodes and others make Captcha a request (such arsenic cloudflare CDN & Google if it sees tons of traffic).

First up lets presume you person a moving Linux machine, I’ll spell with Ubuntu 14.04 (Trusty). Secondly lets presume you are NAT’ed down a bog modular router.

We request to instal tor and tor-arm. To do we request to adhd the Tor repos:

echo 'deb http://deb.torproject.org/torproject.org trusty main' >> /etc/apt/sources.list echo 'deb-src http://deb.torproject.org/torproject.org trusty main' >> /etc/apt/sources.list

Next, instal the GPG keys for the repo:

gpg --keyserver keys.gnupg.net --recv 886DDD89 gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | sudo apt-key adhd -

Now instal tor, tor-arm, curl, vnstat, nginx and socat:

apt-get update apt-get instal tor tor-arm vnstat vnstati nginx curl socat

Weyhey, Tor is installed. By default it acts arsenic a customer truthful we request to make it into an exit node.

Replace the contents of /etc/tor/torrc pinch a basal relay configuration.

curl -o /etc/tor/torrc https://madpsy.uk/wp-content/uploads/2015/11/torrc.txt

The sample configuration looks for illustration this:

ORPort 127.0.0.1:9001 NoAdvertise ORPort 443 NoListen DirPort 9030 Nickname TorExit RelayBandwidthRate 100 KB RelayBandwidthBurst 100 KB ContactInfo [email protected] DisableDebuggerAttachment 0 ExitPolicy judge *:20-23 # FTP, SSH, telnet ... ... ExitPolicy cull *:*

Edit /etc/tor/torrc and group your email reside adjacent to ‘ContactInfo’.

You whitethorn besides wish to group ‘RelayBandwidthRate’ and ‘RelayBandwidthBurst’ to thing else, depending connected your Internet relationship speed. The illustration worth is 100 KB (Kilobytes Per Second) which is good for a emblematic ADSL broadband connection. You will announcement ‘DirPort’ is besides set, enabling this node arsenic a Directory Server – region the statement if you don’t want that.

Next, we request to tally socat to redirect larboard 443 postulation to localhost larboard 9001. This is because a useful Entry Guard (the relay will judge incoming connections arsenic good arsenic being an exit node) needs to tally connected a larboard which is apt to beryllium disposable for each Tor user. Port 443 is HTTPS truthful a sensible choice. The problem is Tor doesn’t tally arsenic guidelines and will beryllium denied support erstwhile trying to hindrance to larboard 443. For this logic it’s bound to 9001 locally and we will redirect postulation utilizing ‘socat’.

To tally socat:

/usr/bin/socat TCP-LISTEN:443,fork,su=nobody TCP:127.0.0.1:9001 &

We request to guarantee this starts connected reboot truthful to do that we adhd it to root’s crontab.

echo '@reboot /usr/bin/socat TCP-LISTEN:443,fork,su=nobody TCP:127.0.0.1:9001 &' >> /var/spool/cron/crontabs/root

Almost done! Finally, we request to service an ‘about this node’ page complete HTTP truthful anyone querying what this node is will beryllium capable to find out.

Note: You tin besides do thing akin pinch ‘DirPortFrontPage’, nevertheless I don’t judge it will fto you adhd further contented easy (such arsenic the bandwidth graph).

Replace the default nginx page pinch the charismatic Tor Exit Node page.

curl -o /usr/share/nginx/html/index.html https://madpsy.uk/wp-content/uploads/2015/11/tor-exit-node.txt curl -o /usr/share/nginx/html/how_tor_works_thumb.png https://madpsy.uk/wp-content/uploads/2015/11/how_tor_works_thumb.png

Edit /usr/share/nginx/html/index.html, find ‘[email protected]’ and switch pinch your existent email address.

At the bottommost of the page is simply a bandwidth chart for your node. To make this we usage ‘vnstat’. I will presume eth0 is your Internet interface. We request to adhd different cron for this.

First, tally it erstwhile manually:

/usr/bin/vnstati -i eth0 -vs -o /usr/share/nginx/html/vnstat.png

Then adhd the cron truthful it runs connected the hour, each hour:

echo '00 * * * * /usr/bin/vnstati -i eth0 -vs -o /usr/share/nginx/html/vnstat.png' >> /var/spool/cron/crontabs/root

You tin now position this info page by browsing to your node’s IP successful a browser (e.g. http://192.168.0.10). You should spot the info page and the chart astatine the bottom. The info page and chart should look thing for illustration this:

The last shape (I promise) is to execute basal larboard forwarding connected your router truthful HTTP, Tor Relay and Tor Directory are accessible from the Internet. If you don’t do this your Tor Exit Node/Relay is useless.

You want to guardant TCP/80, TCP/443 and TCP/9030 to the IP reside of your shiny caller Tor Node – for illustration 192.168.0.10.

In lawsuit you don’t already cognize really to do this, it seems this tract is uber useful: portforward.com

You tin trial this worked by browsing to your nationalist IP reside and make judge you spot the aforesaid info page arsenic before. In lawsuit you were wondering Tor handles move IP addresses conscionable fine, you don’t request to do thing pinch hostnames aliases DNS etc.

I did committedness that was the past thing, which it fundamentally was 🙂

One past thing! We must restart Tor truthful picks up our caller configuration. We waited until aft configuring larboard forwarding arsenic 1 of the first point Tor will do is make judge the larboard is unfastened from the Internet.

To restart Tor, simply run:

/etc/init.d/tor restart

You tin show what your node is up to pinch ‘arm’. Just run:

sudo -u debian-tor arm

At the apical will beryllium a ‘fingerprint’, thing for illustration ‘GH35AJCVH421742CCJFPQIUCB1835947B4399’.

You tin usage this fingerprint to hunt ‘Atlas‘ for specifications connected your Node. Alternatively you tin besides hunt for your nationalist IP address.

If you are moving an exit node connected a VM aliases dedicated server astatine a hosting institution (much amended thought than moving from home) past it is besides worthy asking the hosting supplier for a reverse DNS grounds for your IP address. I will presume you already person a domain name. Where xxx.xxx.xxxx.xxx is your server’s IP:

tor-exit1-readme.yourdomain.com  A   xxx.xxx.xxx.xxx
xxx.xxx.xxx.xxx.in-addr.arpa     PTR    tor-exit1-readme.yourdomain.com

This is truthful anyone looking up what your exit node’s IP is (from their logs etc) will apt spot the reverse grounds and effort to position it successful a browser – successful which lawsuit they will spot your Tor info page.

In summation to this it is worthy while letting the hosting provider know what your server is going to beryllium doing. That way, providing they are not idiots, they will understand why they whitethorn person immoderate complaints. There is not constituent successful letting your location ISP cognize – they will apt either beryllium clueless aliases show you it’s against their T&C’s and terminate your account!

Essential Reading: For much accusation connected really to safely tally a Tor Exit Node, spot this blog post.

I mentioned your relay will besides beryllium an Entry Guard. It will typically return 70+ days earlier your Node is simply a afloat trusted Guard and moving to its afloat potential. For much accusation connected Entry Guard spot this blog post.