@@ -21,39 +21,39 @@ information in the debug log about your Tor configuration.
2121The first step is running Bitcoin Core behind a Tor proxy. This will already anonymize all
2222outgoing connections, but more is possible.
2323
24- -proxy=ip:port Set the proxy server. If SOCKS5 is selected (default), this proxy
25- server will be used to try to reach .onion addresses as well.
26- You need to use -noonion or -onion=0 to explicitly disable
27- outbound access to onion services.
28-
29- -onion=ip:port Set the proxy server to use for Tor onion services. You do not
30- need to set this if it's the same as -proxy. You can use -onion=0
31- to explicitly disable access to onion services.
32- Note: Only the -proxy option sets the proxy for DNS requests;
33- with -onion they will not route over Tor, so use -proxy if you
34- have privacy concerns.
35-
36- -listen When using -proxy, listening is disabled by default. If you want
37- to manually configure an onion service (see section 3), you'll
38- need to enable it explicitly.
39-
40- -connect=X When behind a Tor proxy, you can specify .onion addresses instead
41- -addnode=X of IP addresses or hostnames in these parameters. It requires
42- -seednode=X SOCKS5. In Tor mode, such addresses can also be exchanged with
43- other P2P nodes.
44-
45- -onlynet=onion Make outgoing connections only to .onion addresses. Incoming
46- connections are not affected by this option. This option can be
47- specified multiple times to allow multiple network types, e.g.
48- ipv4, ipv6 or onion. If you use this option with values other
49- than onion you *cannot* disable onion connections; outgoing onion
50- connections will be enabled when you use -proxy or -onion. Use
51- -noonion or -onion=0 if you want to be sure there are no outbound
52- onion connections over the default proxy or your defined -proxy.
24+ -proxy=ip:port Set the proxy server. If SOCKS5 is selected (default), this proxy
25+ server will be used to try to reach .onion addresses as well.
26+ You need to use -noonion or -onion=0 to explicitly disable
27+ outbound access to onion services.
28+
29+ -onion=ip:port Set the proxy server to use for Tor onion services. You do not
30+ need to set this if it's the same as -proxy. You can use -onion=0
31+ to explicitly disable access to onion services.
32+ Note: Only the -proxy option sets the proxy for DNS requests;
33+ with -onion they will not route over Tor, so use -proxy if you
34+ have privacy concerns.
35+
36+ -listen When using -proxy, listening is disabled by default. If you want
37+ to manually configure an onion service (see section 3), you'll
38+ need to enable it explicitly.
39+
40+ -connect=X When behind a Tor proxy, you can specify .onion addresses instead
41+ -addnode=X of IP addresses or hostnames in these parameters. It requires
42+ -seednode=X SOCKS5. In Tor mode, such addresses can also be exchanged with
43+ other P2P nodes.
44+
45+ -onlynet=onion Make outgoing connections only to .onion addresses. Incoming
46+ connections are not affected by this option. This option can be
47+ specified multiple times to allow multiple network types, e.g.
48+ ipv4, ipv6 or onion. If you use this option with values other
49+ than onion you *cannot* disable onion connections; outgoing onion
50+ connections will be enabled when you use -proxy or -onion. Use
51+ -noonion or -onion=0 if you want to be sure there are no outbound
52+ onion connections over the default proxy or your defined -proxy.
5353
5454In a typical situation, this suffices to run behind a Tor proxy:
5555
56- ./bitcoind -proxy=127.0.0.1:9050
56+ ./bitcoind -proxy=127.0.0.1:9050
5757
5858## 2. Automatically create a Bitcoin Core onion service
5959
@@ -152,57 +152,57 @@ details).
152152You can also manually configure your node to be reachable from the Tor network.
153153Add these lines to your ` /etc/tor/torrc ` (or equivalent config file):
154154
155- HiddenServiceDir /var/lib/tor/bitcoin-service/
156- HiddenServicePort 8333 127.0.0.1:8334
155+ HiddenServiceDir /var/lib/tor/bitcoin-service/
156+ HiddenServicePort 8333 127.0.0.1:8334
157157
158158The directory can be different of course, but virtual port numbers should be equal to
159159your bitcoind's P2P listen port (8333 by default), and target addresses and ports
160160should be equal to binding address and port for inbound Tor connections (127.0.0.1:8334 by default).
161161
162- -externalip=X You can tell bitcoin about its publicly reachable addresses using
163- this option, and this can be an onion address. Given the above
164- configuration, you can find your onion address in
165- /var/lib/tor/bitcoin-service/hostname. For connections
166- coming from unroutable addresses (such as 127.0.0.1, where the
167- Tor proxy typically runs), onion addresses are given
168- preference for your node to advertise itself with.
169-
170- You can set multiple local addresses with -externalip. The
171- one that will be rumoured to a particular peer is the most
172- compatible one and also using heuristics, e.g. the address
173- with the most incoming connections, etc.
174-
175- -listen You'll need to enable listening for incoming connections, as this
176- is off by default behind a proxy.
177-
178- -discover When -externalip is specified, no attempt is made to discover local
179- IPv4 or IPv6 addresses. If you want to run a dual stack, reachable
180- from both Tor and IPv4 (or IPv6), you'll need to either pass your
181- other addresses using -externalip, or explicitly enable -discover.
182- Note that both addresses of a dual-stack system may be easily
183- linkable using traffic analysis.
162+ -externalip=X You can tell bitcoin about its publicly reachable addresses using
163+ this option, and this can be an onion address. Given the above
164+ configuration, you can find your onion address in
165+ /var/lib/tor/bitcoin-service/hostname. For connections
166+ coming from unroutable addresses (such as 127.0.0.1, where the
167+ Tor proxy typically runs), onion addresses are given
168+ preference for your node to advertise itself with.
169+
170+ You can set multiple local addresses with -externalip. The
171+ one that will be rumoured to a particular peer is the most
172+ compatible one and also using heuristics, e.g. the address
173+ with the most incoming connections, etc.
174+
175+ -listen You'll need to enable listening for incoming connections, as this
176+ is off by default behind a proxy.
177+
178+ -discover When -externalip is specified, no attempt is made to discover local
179+ IPv4 or IPv6 addresses. If you want to run a dual stack, reachable
180+ from both Tor and IPv4 (or IPv6), you'll need to either pass your
181+ other addresses using -externalip, or explicitly enable -discover.
182+ Note that both addresses of a dual-stack system may be easily
183+ linkable using traffic analysis.
184184
185185In a typical situation, where you're only reachable via Tor, this should suffice:
186186
187- ./bitcoind -proxy=127.0.0.1:9050 -externalip=7zvj7a2imdgkdbg4f2dryd5rgtrn7upivr5eeij4cicjh65pooxeshid.onion -listen
187+ ./bitcoind -proxy=127.0.0.1:9050 -externalip=7zvj7a2imdgkdbg4f2dryd5rgtrn7upivr5eeij4cicjh65pooxeshid.onion -listen
188188
189189(obviously, replace the .onion address with your own). It should be noted that you still
190190listen on all devices and another node could establish a clearnet connection, when knowing
191191your address. To mitigate this, additionally bind the address of your Tor proxy:
192192
193- ./bitcoind ... -bind=127.0.0.1
193+ ./bitcoind ... -bind=127.0.0.1
194194
195195If you don't care too much about hiding your node, and want to be reachable on IPv4
196196as well, use ` discover ` instead:
197197
198- ./bitcoind ... -discover
198+ ./bitcoind ... -discover
199199
200200and open port 8333 on your firewall (or use port mapping, i.e., ` -upnp ` or ` -natpmp ` ).
201201
202202If you only want to use Tor to reach .onion addresses, but not use it as a proxy
203203for normal IPv4/IPv6 communication, use:
204204
205- ./bitcoind -onion=127.0.0.1:9050 -externalip=7zvj7a2imdgkdbg4f2dryd5rgtrn7upivr5eeij4cicjh65pooxeshid.onion -discover
205+ ./bitcoind -onion=127.0.0.1:9050 -externalip=7zvj7a2imdgkdbg4f2dryd5rgtrn7upivr5eeij4cicjh65pooxeshid.onion -discover
206206
207207## 4. Privacy recommendations
208208
0 commit comments