Privacy tooling
What is Tor exit node?
A Tor exit node is the final relay in a circuit, which connects to the destination and therefore appears to be the source of the traffic. Exits receive abuse complaints for traffic carried on behalf of others, which is why many hosts prohibit them and why we permit them only in approved jurisdictions with a published abuse contact.
Why Tor exit node matters
Exits receive abuse complaints for traffic carried on behalf of others, which is why many hosts prohibit them and why we permit them only in approved jurisdictions with a published abuse contact.
Tor exit node in practice
When running a Tor exit node, you are operating the relay that terminates circuits and makes your IP the destination's visible source. You would monitor outbound traffic, watch for abuse complaints, and maintain a published abuse contact. You would also configure torrc carefully, because misconfiguration can leak DNS or allow non-Tor traffic to exit, which turns your instance into an open proxy. Getting it wrong means your IP gets blocked by services, or your provider gets a complaint about traffic you merely carried.
What people get wrong about Tor exit node
People assume an exit node sees the plaintext of all traffic it carries. It does not. Traffic inside the Tor network is layered-encrypted, and only the final hop is decrypted. The exit sees the destination IP and, for plaintext protocols, the content. But it cannot learn the original sender's IP or the full circuit, because the circuit is built in stages and no single relay knows both ends.
Tor exit node — common questions
Why do hosts ban Tor exit nodes?
Because exits receive abuse complaints for traffic they carry on behalf of others. Services and authorities contact the operator of the exit's IP, which can be the hosting provider. Many hosts lack the staff or appetite to handle those complaints, so they simply prohibit exits in their terms. We permit them only in approved jurisdictions with a published abuse contact.
What does an exit node see and not see?
An exit sees the destination IP and, for unencrypted protocols, the full plaintext of the traffic as it leaves the Tor network. It does not see the sender's IP address or the complete circuit path, because layers of encryption are stripped hop by hop. The operator can know what traffic exited through their relay, but not who originally requested it.
More from privacy tooling
- WireGuard
- WireGuard is a VPN protocol implemented in about 4,000 lines of kernel code with a fixed modern cipher suite.
- OpenVPN
- OpenVPN is a mature userspace VPN protocol with configurable ciphers that can run over TCP or UDP.
- Tor
- Tor routes traffic through three volunteer-operated relays chosen so that no single relay knows both the origin and the destination.
- Onion service
- An onion service is a service reachable only through Tor, whose address is derived from its public key rather than registered with any authority.
- SOCKS5
- SOCKS5 is a proxy protocol that forwards arbitrary TCP and UDP traffic, with optional authentication.
- Shadowsocks
- Shadowsocks is an encrypted proxy protocol designed to be difficult to identify by traffic analysis.
- No-logs policy
- A no-logs policy is a commitment not to retain records of user activity such as connection metadata, netflow or DNS queries.