I would like to deny my Hidden Services (HS) to speak with any servers from one country but I would like to allow other hop of my circuit to be from that country

For example my HS is hosted in country X, I would to deny my HS to communicate directly to any servers in this country X but the HS is allowed to have country X for the second or last hop of his circuit

Is this possible ?

1 Answer 1


In full - impossible, because HSDir, for example, is a passive replica, i.e. you are not controlling how it's formed. Partially - with nodes in chains - you can utilize ExcludeNodes and ExcludeExitNodes with StrictNodes 1 in 2-instance setup - but it will barely help you... And it's not a flaw of Tor: such selection ability would be a great deanonymization possibility and quite good for fingerprinting your HS

  • won't help either: iptables are unable to "dig into" the Tor circuit pipes, i.e. it will disable only the 1st hops of any kind in the particular IP ranges
    – Alexey Vesnin
    Oct 3, 2017 at 0:24
  • well, then try using iptables + 2-instance setup. One instance is a hidden bridge with exludenodes - and it's the gateway for the second tor instance carrying HS itself. but HSDir's will have your HS descriptor even in this country regardless of your will
    – Alexey Vesnin
    Oct 3, 2017 at 0:27
  • no, just 2 Exclude's I've mentioned and set StrictNodes 1, that's on the bridge-instance. HS instance uses just this bridge and has no excludes in it
    – Alexey Vesnin
    Oct 3, 2017 at 0:40
  • not the middle ones - they can not be selected or filtered out.
    – Alexey Vesnin
    Oct 3, 2017 at 0:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .