I would like to create an private exit node that only I have access, it will be set on my personal computer, then plan to create "exit node" to relatives who live USA and France so I can have a fully encrypted system for use with a vpn without worrying if the site is http or https. It is possible to do or is it safe to create this kind of "private exit node" with only people in my circle of trust, to use database and sensitive data sites?
It is possible to setup non-published (private) exit node, but managing it is inconvenient. The node should be added to the client manually via ControlPort, using router descriptor, and the circuit over that Exit Node need to be build also manually.
The algorithm in general is as follows. On server:
- Configure Tor exit node as per official instructions
- Add the following to the configuration file to make it private:
PublishServerDescriptor 0, and also activate DirPort on localhost:
DirPort 127.0.0.1:9093 NoAdvertise
- Run Tor Exit node, grab its descriptor:
curl http://127.0.0.1:9093/tor/server/authority, save it somewhere
- Your Exit desciptor contains
fingerprintline with the fingerprint separated with spaces. Remove all spaces (make it 40 symbol string). That's the fingerprint of Exit Node
UseMicrodescriptors 0(microdescriptors can't be easily managed outside of consensus, we'll work with full descriptors), activate ControlPort
- Start Tor client
- Connect to ControlPort, authenticate with AUTHENTICATE command (check controlspec)
- Add Exit descriptor by running:
+POSTDESCRIPTOR cache=yes purpose=controller, paste the descriptor, end with
- Check connected circuits:
GETINFO circuit-status. You should see circuits in the form like this:
4 BUILT $7A35EE286D3FDBB272F39D4916F0879EE12EA581~TK998,$40E82B3E7B9167BC2B8B8B94F8CC4F48317BDAC6~tirz,$07F0E652E4CCB0A0F1E88D0046ECB322E6318C86~RiggsOceanlock BUILD_FLAGS=IS_INTERNAL,NEED_CAPACITY,NEED_UPTIME PURPOSE=GENERAL TIME_CREATED=2022-07-12T20:27:24.770156
This is a 3-hop circuit:
- Grab any 3-hop circuit and replace the latest hop with the Fingerprint of your Exit Node.
EXTENDCIRCUIT 0 7A35EE286D3FDBB272F39D4916F0879EE12EA581,40E82B3E7B9167BC2B8B8B94F8CC4F48317BDAC6,YOURFINGERPRINTHERE
- Now you can use your private Exit Node, however to reliably use it, you'll need to map exact IP addresses/domains to it. In ControlPort:
ADDRMAP ifconfig.co ifconfig.co.YOURFINGERPRINTHERE.exit
Now ifconfig.co would open via your private Exit Node.
This all could be automated with stem custom path selection.