5

I would like to create an private exit node that only I have access, it will be set on my personal computer, then plan to create "exit node" to relatives who live USA and France so I can have a fully encrypted system for use with a vpn without worrying if the site is http or https. It is possible to do or is it safe to create this kind of "private exit node" with only people in my circle of trust, to use database and sensitive data sites?

Improve this question
3
  • 4
    It doesn't sound like you need Tor for this. Just set your PC as a VPN server and limit users by login.
    – Andrew Lott
    Commented Jan 27, 2014 at 17:31
  • 3
    Since you won't be getting any anonymity out of this (what Tor is designed for) you're just introducing needless latency into your connections. A VPN or encrypted proxy will provide you with what you want.
    – user5
    Commented Mar 5, 2014 at 23:38
  • For all intents and purposes, you can achieve the same result using VPN Over Tor.
    – Oliver Offing
    Commented May 20, 2022 at 16:32

2 Answers 2

Reset to default
7

Tor does not have a concept of exit nodes that only you can use.

The routing protocol allows for it, but there is no support in Tor or its directory layer for what you ask.

Improve this answer
0

It is possible to setup non-published (private) exit node, but managing it is inconvenient. The node should be added to the client manually via ControlPort, using router descriptor, and the circuit over that Exit Node need to be build also manually.

The algorithm in general is as follows. On server:

  1. Configure Tor exit node as per official instructions
  2. Add the following to the configuration file to make it private: PublishServerDescriptor 0, and also activate DirPort on localhost: DirPort 127.0.0.1:9093 NoAdvertise
  3. Run Tor Exit node, grab its descriptor: curl http://127.0.0.1:9093/tor/server/authority, save it somewhere
  4. Your Exit desciptor contains fingerprint line with the fingerprint separated with spaces. Remove all spaces (make it 40 symbol string). That's the fingerprint of Exit Node

On client:

  1. Set UseMicrodescriptors 0 (microdescriptors can't be easily managed outside of consensus, we'll work with full descriptors), activate ControlPort
  2. Start Tor client
  3. Connect to ControlPort, authenticate with AUTHENTICATE command (check controlspec)
  4. Add Exit descriptor by running: +POSTDESCRIPTOR cache=yes purpose=controller, paste the descriptor, end with . (dot)
  5. Check connected circuits: GETINFO circuit-status. You should see circuits in the form like this:
4 BUILT $7A35EE286D3FDBB272F39D4916F0879EE12EA581~TK998,$40E82B3E7B9167BC2B8B8B94F8CC4F48317BDAC6~tirz,$07F0E652E4CCB0A0F1E88D0046ECB322E6318C86~RiggsOceanlock BUILD_FLAGS=IS_INTERNAL,NEED_CAPACITY,NEED_UPTIME PURPOSE=GENERAL TIME_CREATED=2022-07-12T20:27:24.770156

This is a 3-hop circuit: 7A35EE286D3FDBB272F39D4916F0879EE12EA581, 40E82B3E7B9167BC2B8B8B94F8CC4F48317BDAC6,07F0E652E4CCB0A0F1E88D0046ECB322E6318C86

  1. Grab any 3-hop circuit and replace the latest hop with the Fingerprint of your Exit Node.
  2. Run EXTENDCIRCUIT 0 7A35EE286D3FDBB272F39D4916F0879EE12EA581,40E82B3E7B9167BC2B8B8B94F8CC4F48317BDAC6,YOURFINGERPRINTHERE
  3. Now you can use your private Exit Node, however to reliably use it, you'll need to map exact IP addresses/domains to it. In ControlPort: ADDRMAP ifconfig.co ifconfig.co.YOURFINGERPRINTHERE.exit

Now ifconfig.co would open via your private Exit Node.
This all could be automated with stem custom path selection.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .