Skip to content

Commit 193f9a9

Browse files
jonatackjonatack
committed
doc: update tor.md manual config, move after automatic config
1 parent 9af99b6 commit 193f9a9

File tree

1 file changed

+63
-65
lines changed

1 file changed

+63
-65
lines changed

‎doc/tor.md

Lines changed: 63 additions & 65 deletions
Original file line numberDiff line numberDiff line change
@@ -34,8 +34,8 @@ outgoing connections, but more is possible.
3434
have privacy concerns.
3535

3636
-listen When using -proxy, listening is disabled by default. If you want
37-
to run an onion service (see next section), you'll need to enable
38-
it explicitly.
37+
to manually configure an onion service (see section 3), you'll
38+
need to enable it explicitly.
3939

4040
-connect=X When behind a Tor proxy, you can specify .onion addresses instead
4141
-addnode=X of IP addresses or hostnames in these parameters. It requires
@@ -55,67 +55,7 @@ In a typical situation, this suffices to run behind a Tor proxy:
5555

5656
./bitcoind -proxy=127.0.0.1:9050
5757

58-
59-
## 2. Manually create a Bitcoin Core onion service
60-
61-
If you configure your Tor system accordingly, it is possible to make your node also
62-
reachable from the Tor network. Add these lines to your /etc/tor/torrc (or equivalent
63-
config file): *Needed for Tor version 0.2.7.0 and older versions of Tor only. For newer
64-
versions of Tor see [Section 3](#3-automatically-listen-on-tor).*
65-
66-
HiddenServiceDir /var/lib/tor/bitcoin-service/
67-
HiddenServicePort 8333 127.0.0.1:8334
68-
69-
The directory can be different of course, but virtual port numbers should be equal to
70-
your bitcoind's P2P listen port (8333 by default), and target addresses and ports
71-
should be equal to binding address and port for inbound Tor connections (127.0.0.1:8334 by default).
72-
73-
-externalip=X You can tell bitcoin about its publicly reachable addresses using
74-
this option, and this can be an onion address. Given the above
75-
configuration, you can find your onion address in
76-
/var/lib/tor/bitcoin-service/hostname. For connections
77-
coming from unroutable addresses (such as 127.0.0.1, where the
78-
Tor proxy typically runs), onion addresses are given
79-
preference for your node to advertise itself with.
80-
81-
You can set multiple local addresses with -externalip. The
82-
one that will be rumoured to a particular peer is the most
83-
compatible one and also using heuristics, e.g. the address
84-
with the most incoming connections, etc.
85-
86-
-listen You'll need to enable listening for incoming connections, as this
87-
is off by default behind a proxy.
88-
89-
-discover When -externalip is specified, no attempt is made to discover local
90-
IPv4 or IPv6 addresses. If you want to run a dual stack, reachable
91-
from both Tor and IPv4 (or IPv6), you'll need to either pass your
92-
other addresses using -externalip, or explicitly enable -discover.
93-
Note that both addresses of a dual-stack system may be easily
94-
linkable using traffic analysis.
95-
96-
In a typical situation, where you're only reachable via Tor, this should suffice:
97-
98-
./bitcoind -proxy=127.0.0.1:9050 -externalip=7zvj7a2imdgkdbg4f2dryd5rgtrn7upivr5eeij4cicjh65pooxeshid.onion -listen
99-
100-
(obviously, replace the .onion address with your own). It should be noted that you still
101-
listen on all devices and another node could establish a clearnet connection, when knowing
102-
your address. To mitigate this, additionally bind the address of your Tor proxy:
103-
104-
./bitcoind ... -bind=127.0.0.1
105-
106-
If you don't care too much about hiding your node, and want to be reachable on IPv4
107-
as well, use `discover` instead:
108-
109-
./bitcoind ... -discover
110-
111-
and open port 8333 on your firewall (or use port mapping, i.e., `-upnp` or `-natpmp`).
112-
113-
If you only want to use Tor to reach .onion addresses, but not use it as a proxy
114-
for normal IPv4/IPv6 communication, use:
115-
116-
./bitcoind -onion=127.0.0.1:9050 -externalip=7zvj7a2imdgkdbg4f2dryd5rgtrn7upivr5eeij4cicjh65pooxeshid.onion -discover
117-
118-
## 3. Automatically create a Bitcoin Core onion service
58+
## 2. Automatically create a Bitcoin Core onion service
11959

12060
Bitcoin Core makes use of Tor's control socket API to create and destroy
12161
ephemeral onion services programmatically. This means that if Tor is running and
@@ -206,10 +146,68 @@ password` (refer to the [Tor Dev
206146
Manual](https://2019.www.torproject.org/docs/tor-manual.html.en) for more
207147
details).
208148

149+
150+
## 3. Manually create a Bitcoin Core onion service
151+
152+
You can also manually configure your node to be reachable from the Tor network.
153+
Add these lines to your `/etc/tor/torrc` (or equivalent config file):
154+
155+
HiddenServiceDir /var/lib/tor/bitcoin-service/
156+
HiddenServicePort 8333 127.0.0.1:8334
157+
158+
The directory can be different of course, but virtual port numbers should be equal to
159+
your bitcoind's P2P listen port (8333 by default), and target addresses and ports
160+
should be equal to binding address and port for inbound Tor connections (127.0.0.1:8334 by default).
161+
162+
-externalip=X You can tell bitcoin about its publicly reachable addresses using
163+
this option, and this can be an onion address. Given the above
164+
configuration, you can find your onion address in
165+
/var/lib/tor/bitcoin-service/hostname. For connections
166+
coming from unroutable addresses (such as 127.0.0.1, where the
167+
Tor proxy typically runs), onion addresses are given
168+
preference for your node to advertise itself with.
169+
170+
You can set multiple local addresses with -externalip. The
171+
one that will be rumoured to a particular peer is the most
172+
compatible one and also using heuristics, e.g. the address
173+
with the most incoming connections, etc.
174+
175+
-listen You'll need to enable listening for incoming connections, as this
176+
is off by default behind a proxy.
177+
178+
-discover When -externalip is specified, no attempt is made to discover local
179+
IPv4 or IPv6 addresses. If you want to run a dual stack, reachable
180+
from both Tor and IPv4 (or IPv6), you'll need to either pass your
181+
other addresses using -externalip, or explicitly enable -discover.
182+
Note that both addresses of a dual-stack system may be easily
183+
linkable using traffic analysis.
184+
185+
In a typical situation, where you're only reachable via Tor, this should suffice:
186+
187+
./bitcoind -proxy=127.0.0.1:9050 -externalip=7zvj7a2imdgkdbg4f2dryd5rgtrn7upivr5eeij4cicjh65pooxeshid.onion -listen
188+
189+
(obviously, replace the .onion address with your own). It should be noted that you still
190+
listen on all devices and another node could establish a clearnet connection, when knowing
191+
your address. To mitigate this, additionally bind the address of your Tor proxy:
192+
193+
./bitcoind ... -bind=127.0.0.1
194+
195+
If you don't care too much about hiding your node, and want to be reachable on IPv4
196+
as well, use `discover` instead:
197+
198+
./bitcoind ... -discover
199+
200+
and open port 8333 on your firewall (or use port mapping, i.e., `-upnp` or `-natpmp`).
201+
202+
If you only want to use Tor to reach .onion addresses, but not use it as a proxy
203+
for normal IPv4/IPv6 communication, use:
204+
205+
./bitcoind -onion=127.0.0.1:9050 -externalip=7zvj7a2imdgkdbg4f2dryd5rgtrn7upivr5eeij4cicjh65pooxeshid.onion -discover
206+
209207
## 4. Privacy recommendations
210208

211-
- Do not add anything but Bitcoin Core ports to the onion service created in section 2.
209+
- Do not add anything but Bitcoin Core ports to the onion service created in section 3.
212210
If you run a web service too, create a new onion service for that.
213211
Otherwise it is trivial to link them, which may reduce privacy. Onion
214-
services created automatically (as in section 3) always have only one port
212+
services created automatically (as in section 2) always have only one port
215213
open.

0 commit comments

Comments
 (0)