OPENING TOR EXIT RELAY MANUAL...
LOADING EXIT POLICY...
STATUS: HIGH RESPONSIBILITY MODE

BACK

TOR EXIT RELAY :: PUBLIC EXIT NODE

> The final hop between Tor users and the public internet.
> Useful for the network, but much more exposed than a middle relay or bridge.

TL;DR: Running an exit relay helps Tor users reach the open internet, but your server IP becomes the visible source of their outbound traffic.

IMPORTANT: Do not run an exit relay from a home connection unless you fully understand the consequences. Use a Tor-friendly VPS/hosting provider, publish a clear contact address, expect abuse reports, and start with a reduced exit policy.

WHAT IS A TOR EXIT RELAY?

A Tor exit relay is the last relay in a Tor circuit. It connects from the Tor network to the destination service on the public internet. Because of that, the destination website or service sees the exit relay IP address, not the Tor user's real IP address.

Exit relays are important because they let Tor users access regular websites and services. However, they also receive more abuse complaints than bridges or middle relays, because outbound traffic appears to come from the exit relay IP.

WHY IT MATTERS

Exit relays help people access the open internet through Tor, especially where privacy, safety, and censorship resistance matter.

RISK LEVEL

Higher than a bridge or middle relay. Your IP may receive complaints, blocks, CAPTCHAs, or provider abuse tickets.

BEFORE YOU START

Recommended setup: dedicated VPS, Tor-friendly provider, no personal/home IP, valid reverse DNS if possible, a monitored contact email, and a clear abuse response template.

If you are unsure, run a middle relay first. It helps the network without allowing exit traffic to the public internet.

PREPARE THE SERVER

cluster@exit:~$ update-system

sudo apt update
sudo apt full-upgrade -y
sudo reboot

After the reboot:

sudo apt install unattended-upgrades apt-listchanges -y
sudo dpkg-reconfigure unattended-upgrades

Answer Yes. Automatic security updates are strongly recommended for public relays.

INSTALL TOR

sudo apt update
sudo apt install tor -y

BACK UP THE CURRENT TOR CONFIGURATION

sudo cp /etc/tor/torrc /etc/tor/torrc.bak

Edit the Tor configuration file:

sudo nano /etc/tor/torrc

BASIC EXIT RELAY CONFIGURATION

You can start with a conservative HTTPS/HTTP/DNS-only exit policy:

## Tor Exit Relay - Conservative Starter Config

Nickname XXXXXXXXX
ContactInfo admin@example.com

## Public relay port
ORPort 9001

## Do not expose a local SOCKS proxy
SocksPort 0

## Enable exit relay mode
ExitRelay 1

## Conservative exit policy
## Allows DNS, HTTP, and HTTPS only
ExitPolicy accept *:53
ExitPolicy accept *:80
ExitPolicy accept *:443
ExitPolicy reject *:*

## Bandwidth limit example
## 10 Mbit/s is approximately 1250 KBytes/s
RelayBandwidthRate 1250 KBytes
RelayBandwidthBurst 1250 KBytes

## Optional traffic accounting
AccountingStart day 03:00
AccountingMax 20 GBytes

Replace these values with your own:

Nickname XXXXXXXXX
ContactInfo admin@example.com

OPTION: REDUCED EXIT POLICY

The Tor Project recommends starting with a reduced exit policy, especially for new operators or new hosting providers. On some Tor versions, this can be enabled with:

ReducedExitPolicy 1

A reduced policy lowers the amount of risky outbound traffic and can reduce abuse reports. You can open more ports later when you are comfortable handling exit relay operations.

OPEN THE RELAY PORT

sudo apt install ufw -y
sudo ufw allow from YOUR_PC_IP to any port 22 proto tcp
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 9001/tcp
sudo ufw enable
sudo ufw status verbose

The exit traffic itself is outbound traffic. The public inbound port that must be reachable is your ORPort, here 9001/tcp.

DNS FOR EXIT RELAYS

Exit relays perform DNS resolution for Tor clients. Reliable and fast DNS matters. For a production exit relay, consider a local caching resolver such as unbound.

sudo apt install unbound -y
sudo systemctl enable unbound
sudo systemctl restart unbound

RESTART TOR

sudo systemctl enable tor
sudo systemctl restart tor
sudo systemctl status tor --no-pager

The service should be active (running).

CHECK THE LOGS

sudo journalctl -u tor -e

If the following lines appear, the relay is working correctly:

Bootstrapped 100%: Done
Self-testing indicates your ORPort is reachable from the outside
Publishing server descriptor

OPERATION NOTES

CONTACT INFO

Keep ContactInfo valid and monitored. Abuse teams and Tor operators may need to reach you.

ABUSE REPORTS

Expect reports. Answer calmly, explain that this is a Tor exit relay, and provide links to Tor abuse documentation.

HOSTING PROVIDER

Make sure your provider explicitly allows Tor exit relays. If not, run a middle relay or bridge instead.

HOME NETWORK

Avoid running this at home. A bridge or middle relay is usually a much better fit for a residential connection.

SOURCES

Source: Tor Project - Exit Relay Setup
Source: Tor Project - Debian / Ubuntu Relay Setup

BACK CONTACT