Skip to content
atori.tech

2.2 Anonymous networking

Out of the box, monerod broadcasts your transactions over the clearnet, so peers could link a transaction to your IP address. In this step you:

  1. Broadcast your own transactions over Tor (tx-proxy)
  2. Publish an onion address for your restricted RPC, so your wallets can reach the node from anywhere without opening router ports

Requirements

Tor onion service for the RPC

Edit Tor's configuration:

sudo nano /etc/tor/torrc

Add at the end:

# MoneroBox: monerod restricted RPC (for your wallets)
HiddenServiceDir /var/lib/tor/monero-rpc/
HiddenServicePort 18089 127.0.0.1:18089

Reload Tor and read the new onion address:

sudo systemctl reload tor
sudo cat /var/lib/tor/monero-rpc/hostname

abcdefghijklmnopqrstuvwxyz234567abcdefghijklmnopqrstuvw.onion

Write it into your password manager as your RPC onion. It's for your wallets: keep it private. Anyone who has it can use your node's restricted RPC.

Configure monerod

sudo nano /data/monero/monerod.conf

Add this section:

## Tor
# Send our own transactions ONLY over Tor (max 16 outgoing connections)
tx-proxy=tor,127.0.0.1:9050,16

Your node only makes outgoing Tor connections, to other nodes' onion addresses. It accepts no incoming Tor peers and doesn't announce any onion address of its own on the P2P network.

Restart monerod:

sudo systemctl restart monerod

Validation

After a few minutes, look for Tor peers:

monerod print_cn | grep -ci onion

The number is how many Tor connections your node has open. Anything above 0 means tx-proxy works. You can also look for Tor messages in the log:

grep -i tor /data/monero/monerod.log | tail -20

What changes and what doesn't

  • Your own transactions now leave the node only through Tor. If no Tor peers are connected, monerod waits rather than leaking them to the clearnet.
  • Block sync and relaying other people's transactions still happen over the clearnet. That's normal: it reveals that you run a node, not what you do with it. To hide even that, see Hide all Monero traffic in Tor in 2.1. It's slower, and you can turn it on from the start or only after the initial sync.

Test the RPC onion

From a computer running Tor (or the Tor Browser, which listens on port 9150):

curl -s --socks5-hostname 127.0.0.1:9050 http://YOUR_RPC_ONION.onion:18089/get_info | jq '.status, .synchronized'

"OK"
true

You'll use this onion address for your wallets in the next two steps.

Extras (optional)

Faster Tor relay with disable_noise (less private)

By default, monerod sends constant fixed-size dummy messages over two of its Tor connections, about one 3 KiB message every 10–15 seconds, and slots your real transactions in among them. Someone watching your Tor traffic can't tell when you send. The cost is about 40 MB of traffic a day, and up to a minute of delay for a large transaction.

To send transactions immediately instead, add disable_noise: 

tx-proxy=tor,127.0.0.1:9050,16,disable_noise
For a personal node, keeping the noise (the default) is the better choice.

Troubleshooting

My transaction doesn't show up on the network

With tx-proxy, monerod holds your transaction until it has a Tor peer, and never falls back to the clearnet. Check:

  • Tor is running: systemctl is-active tor@default prints active.
  • The node has Tor peers: monerod print_cn | grep -ci onion is above 0. Right after a restart it can take a few minutes.
  • The tx-proxy line in monerod.conf has no typo, and monerod was restarted after you added it.
The RPC onion doesn't answer
  • A new onion address takes a minute or two to become reachable. Wait, then try again.
  • Check that torrc has the HiddenServicePort 18089 127.0.0.1:18089 line, and that Tor reloaded without errors: sudo journalctl -u tor@default -n 20.
  • Check that the restricted RPC answers locally on the node: curl -s http://127.0.0.1:18089/get_info | jq .status.