{"id":2354,"date":"2021-09-03T15:59:37","date_gmt":"2021-09-03T15:59:37","guid":{"rendered":"https:\/\/dft.wiki\/?p=2354"},"modified":"2026-07-05T00:41:26","modified_gmt":"2026-07-05T04:41:26","slug":"setting-up-a-tor-node-on-ubuntu-20-04","status":"publish","type":"post","link":"https:\/\/dft.wiki\/?p=2354","title":{"rendered":"Setting Up a Tor Node"},"content":{"rendered":"<p>The <strong>Tor Network<\/strong> relies completely on volunteers to route traffic from origin to destination.<\/p>\n<p>If you plan to run an exit node, I recommend using a VPS from a privacy-friendly provider such as <strong>1984Hosting<\/strong> [<a href=\"https:\/\/1984hosting.com\/\">Link<\/a>] (Iceland) or <strong>Njalla<\/strong> [<a href=\"https:\/\/njal.la\/\">Link<\/a>] (Sweden). Refer to the reference list [<a href=\"https:\/\/gitlab.torproject.org\/legacy\/trac\/-\/wikis\/doc\/GoodBadISPs\">Link<\/a>].<\/p>\n<hr \/>\n<p><strong>TYPES OF TOR NODE<\/strong><\/p>\n<p>There are 3 main types of nodes:<\/p>\n<ul>\n<li><strong>Guard<\/strong>\n<ul>\n<li>The entry point of the Tor network.<\/li>\n<\/ul>\n<\/li>\n<li><strong>Relay<\/strong>\n<ul>\n<li>Middle node.<\/li>\n<\/ul>\n<\/li>\n<li><strong>Exit<\/strong>\n<ul>\n<li>Exit node to the public internet.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>Other types, such as Bridges and Snowflakes, are non-advertised hosts that help prevent nations or organizations from blocking publicly listed nodes.<\/p>\n<hr \/>\n<p><strong>SETTING UP UNATTENDED UPGRADES<\/strong><\/p>\n<p>Prepare the server to automatically patch vulnerable applications and keep itself up to date.<\/p>\n<pre>sudo timedatectl set-timezone <strong>America\/New_York<\/strong>\r\nsudo apt update &amp;&amp; sudo apt upgrade -y\r\nsudo apt install unattended-upgrades apt-listchanges -y\r\nsudo nano \/etc\/apt\/apt.conf.d\/50unattended-upgrades<\/pre>\n<p>Uncomment the following lines:<\/p>\n<pre>\"${distro_id}:${distro_codename}-updates\";\r\nUnattended-Upgrade::Remove-Unused-Kernel-Packages \"true\";\r\nUnattended-Upgrade::Remove-Unused-Dependencies \"true\";\r\nUnattended-Upgrade::Automatic-Reboot \"true\";\r\nUnattended-Upgrade::Automatic-Reboot-Time \"17:00\";\r\nUnattended-Upgrade::Automatic-Reboot-WithUsers \"true\";<\/pre>\n<p>Configure the auto-upgrade parameters:<\/p>\n<pre>sudo nano \/etc\/apt\/apt.conf.d\/20auto-upgrades<\/pre>\n<p>Replace the file content with:<\/p>\n<pre>APT::Periodic::Update-Package-Lists \"1\";\r\nAPT::Periodic::Unattended-Upgrade \"1\";\r\nAPT::Periodic::AutocleanInterval \"5\";\r\nAPT::Periodic::Verbose \"1\";<\/pre>\n<p>Test for errors:<\/p>\n<pre>sudo unattended-upgrades --dry-run\r\nsudo cat \/var\/log\/unattended-upgrades\/unattended-upgrades.log<\/pre>\n<p>Then activate Unattended-Upgrades:<\/p>\n<pre>sudo dpkg-reconfigure -plow unattended-upgrades<\/pre>\n<p>Answer <strong>YES<\/strong> to allow automatic download and installation of stable updates.<\/p>\n<p>For Enterprise Linux derivatives (e.g., CentOS, Alma, Rocky), use <code>yum-cron<\/code> to handle package updates. Note that it does not automatically reboot the system when needed (e.g., after a kernel upgrade).<\/p>\n<hr \/>\n<p><strong>INSTALLING AND CONFIGURING THE TOR NODE<\/strong><\/p>\n<pre>sudo apt update &amp;&amp; apt upgrade -y\r\nsudo apt install apt-transport-https -y\r\nwget -qO- https:\/\/deb.torproject.org\/torproject.org\/A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc | sudo gpg --dearmor | sudo tee \/usr\/share\/keyrings\/tor-archive-keyring.gpg &gt;\/dev\/null\r\necho 'deb [signed-by=\/usr\/share\/keyrings\/tor-archive-keyring.gpg] http:\/\/deb.torproject.org\/torproject.org noble main' | sudo tee \/etc\/apt\/sources.list.d\/tor-priject.list\r\nsudo apt update &amp;&amp; sudo apt install tor -y\r\nsudo nano \/etc\/tor\/torrc<\/pre>\n<p>Append or replace the entire file content with:<\/p>\n<pre>Nickname <strong>NodeNick<\/strong>\r\nORPort 443\r\nExitRelay <span style=\"color: #008000;\"><strong>0<\/strong><\/span>\r\nSocksPort 0\r\nControlSocket 0\r\nContactInfo <strong>your@email.com<\/strong><\/pre>\n<p>Note: Setting ExitRelay to <strong><span style=\"color: #ff0000;\">1<\/span><\/strong> will turn this node into an exit relay.<\/p>\n<pre>sudo systemctl restart tor@default\r\nsudo ufw enable\r\nsudo ufw allow 443\r\nsudo ufw status<\/pre>\n<hr \/>\n<p><strong>EXIT RELAY (<span style=\"color: #ff0000;\">only enable if you know what you are doing<\/span>)<\/strong><\/p>\n<p>Set up a reverse DNS with a name containing &#8220;tor-exit&#8221;.<\/p>\n<p>Add the following lines to the <code>torrc<\/code> configuration file:<\/p>\n<pre>ExitRelay 1\r\nDirPort 80\r\nDirPortFrontPage \/var\/www\/index.html<\/pre>\n<p>Download the sample Exit Notice HTML page:<\/p>\n<pre>wget https:\/\/gitweb.torproject.org\/tor.git\/plain\/contrib\/operator-tools\/tor-exit-notice.html -0 DirPortFrontPage \/var\/www\/index.html<\/pre>\n<p>Allow traffic on port 80 through the firewall and restart the <code>tor<\/code> service:<\/p>\n<pre>sudo ufw allow 80\r\nsudo systemctl restart tor@default<\/pre>\n<p>Install a fast, reliable, uncensored DNS resolver on localhost:<\/p>\n<pre>sudo apt install unbound -y\r\nsudo cp \/etc\/resolv.conf \/etc\/resolv.conf.backup\r\necho nameserver 127.0.0.1 | sudo tee \/etc\/resolv.conf\r\nsudo chattr +i \/etc\/resolv.conf\r\n<\/pre>\n<p>Enable Unbound to start on boot:<\/p>\n<pre>sudo systemctl enable --now unbound<\/pre>\n<hr \/>\n<p>ADDITIONAL INFORMATION<\/p>\n<p>The server should appear in the directory [<a href=\"https:\/\/metrics.torproject.org\/rs.html\">Link<\/a>] within 3 hours.<\/p>\n<p>Each node goes through 4 phases in its lifecycle:<\/p>\n<ul>\n<li>1st &#8211; <strong>0 to 3 days<\/strong>\n<ul>\n<li>Unmeasured<\/li>\n<\/ul>\n<\/li>\n<li>2nd &#8211; <strong>3 to 8 days<\/strong>\n<ul>\n<li>Remote Measurement<\/li>\n<\/ul>\n<\/li>\n<li>3rd &#8211; <strong>8 to 68 days<\/strong>\n<ul>\n<li>Ramping Up as a Guard Relay<\/li>\n<\/ul>\n<\/li>\n<li>4th &#8211; <strong>68+ days<\/strong>\n<ul>\n<li>Steady-state Guard Relay<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>Read more about the node lifecycle at [<a href=\"https:\/\/blog.torproject.org\/lifecycle-new-relay\">Link<\/a>].<\/p>\n<p>It is recommended to back up your Tor Identity Keys:<\/p>\n<pre>scp -r root@200.200.200.200:\/var\/lib\/tor\/keys .<\/pre>\n<p>Note: Port 22 may need to be allowed in the firewall before copying. Remember to block it afterward, or restrict access to a trusted source only.<\/p>\n<p>Alternatives to running a Tor Node include Tor Bridge [<a href=\"https:\/\/community.torproject.org\/relay\/setup\/bridge\/debian-ubuntu\/\">Link<\/a>] and Tor Snowflake [<a href=\"https:\/\/dft.wiki\/?p=2346\">Link<\/a>]. All types of volunteers are needed to keep the internet free and accessible.<\/p>\n<hr \/>\n<p>TRAFFIC MONITORING AND LIMITING<\/p>\n<p>Consider setting traffic limits to avoid overage fees from your ISP.<\/p>\n<p>Append the following lines to <strong>\/etc\/tor\/torrc<\/strong>:<\/p>\n<pre>AccountingStart day 0:00\r\nAccountingMax 50 GBytes\r\nRelayBandwidthRate 25 MBytes\r\nRelayBandwidthBurst 100 MBytes<\/pre>\n<p>Note: Speed values are in Megabytes, not Megabits.<\/p>\n<p>The graph below shows CPU and bandwidth usage for a new node under different configurations:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-2426\" src=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2021\/09\/Screenshot_2021-09-21_19-53-43.png\" alt=\"\" width=\"610\" height=\"674\" srcset=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2021\/09\/Screenshot_2021-09-21_19-53-43.png 610w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2021\/09\/Screenshot_2021-09-21_19-53-43-272x300.png 272w\" sizes=\"auto, (max-width: 610px) 100vw, 610px\" \/><\/p>\n<ul>\n<li>A &#8211; Unmeasured (not relaying traffic yet).<\/li>\n<li>B &#8211; Remote Measurement followed by ramping up as a Guard Relay (traffic relayed progressively).<\/li>\n<li>C &#8211; A 35GB per-direction limit was applied to control total data usage.<\/li>\n<li>D &#8211; Both a daily limit and a speed cap of 1.5 MByte\/s were applied, which resulted in higher CPU usage.<\/li>\n<\/ul>\n<p>Do not be surprised if your node consumes 6TB of traffic (inbound + outbound) in under 3 days:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-2458\" src=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2021\/09\/Screenshot_2021-10-03_15-29-30.png\" alt=\"\" width=\"788\" height=\"376\" srcset=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2021\/09\/Screenshot_2021-10-03_15-29-30.png 788w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2021\/09\/Screenshot_2021-10-03_15-29-30-300x143.png 300w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2021\/09\/Screenshot_2021-10-03_15-29-30-768x366.png 768w\" sizes=\"auto, (max-width: 788px) 100vw, 788px\" \/><\/p>\n<p>Monitor traffic in real-time with Tor Nyx [<a href=\"https:\/\/nyx.torproject.org\/\">Link<\/a>]:<\/p>\n<pre>sudo apt-get install nyx -y\r\nsudo nano \/etc\/tor\/torrc<\/pre>\n<p>Append the following lines:<\/p>\n<pre>ControlPort 9051\r\nCookieAuthentication 1<\/pre>\n<p>Restart Tor and launch Nyx:<\/p>\n<pre>sudo systemctl restart tor@default\r\nnyx<\/pre>\n<p>To run Nyx as another user, update the permissions of the token file:<\/p>\n<pre>sudo chmod 777 \/run\/tor\/control.authcookie<\/pre>\n<p>Customize your Nyx console by editing:<\/p>\n<pre>nano .nyx\/config<\/pre>\n<p>Examples can be found at [<a href=\"https:\/\/nyx.torproject.org\/nyxrc.sample\">Link<\/a>].<\/p>\n<hr \/>\n<p><strong>BONUS<\/strong><\/p>\n<p>As an alternative to <code>unattended-upgrades<\/code>, try <strong>uCareSystem<\/strong> [<a href=\"https:\/\/github.com\/Utappia\/uCareSystem\">Link<\/a>]:<\/p>\n<pre>wget https:\/\/github.com\/Utappia\/uCareSystem\/releases\/download\/v25.07.22\/ucaresystem-core_<strong>25.07.22<\/strong>_all.deb\r\nsudo apt install .\/ucaresystem-core_*.deb\r\nsudo ucaresystem-core<\/pre>\n","protected":false},"excerpt":{"rendered":"<p>The Tor Network relies completely on volunteers to route traffic from origin to destination. If [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-2354","post","type-post","status-publish","format-standard","hentry","category-linux"],"_links":{"self":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/2354","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2354"}],"version-history":[{"count":26,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/2354\/revisions"}],"predecessor-version":[{"id":5964,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/2354\/revisions\/5964"}],"wp:attachment":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2354"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2354"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2354"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}