Recently I discovered that there is a tor relay in my own country. While it is a good sign it is impossible to know if the relay is by a good or a bad actor. While the same can be said of any tor relay anywhere in the world, is there a way to set preferences somewhere so tor relays from other countries are preferred over your country.

I do know and understand that it may (or may not) add significant latency on the connection depending upon the application I'm using, for e.g. web pages should be probably instantaneous but something like wget or any bandwidth-intensive application may take a hit.

I am on Debian testing/buster.

1 Answer 1


Well, it depends on the relay's place in the chain:

  • Entry node - yes, you can use EntryNodes {us},{fr} for example, to specify the countries USA and France
  • Middle node - via configuration file - no, but if using Tor control protocol - yes, physically possible, but not a good idea(I'll explain it later).
  • Exit node - yes, you can use ExitNodes {us},{fr} and ExcludeExitNodes {us},{fr} for example, to tell to use or to avoid the nodes listed.
  • Any node - there's an ExcludeNodes {us},{fr} that tell Tor to do it's best to avoid the nodes listed on any place, but there's no strict enforcement/guarantee

If using any of directives above, you must specify StrictNodes 1 in your torrc config to make it actually have an effect. In a curly bracket there can also be a hash-id's of the specific nodes.

About middle nodes - why are they not tweakable via config? Because it can hurt the network badly - it's really easy to implement something like ExcludeMiddleNodes and MiddleNodes directives, but there's a great and grave danger to the anonymity and to the whole network itself: it makes split happen, i.e. we can have 2 or more node groups that do not intersect even by middle nodes, and we have a significant simplification of almost any attack against Tor and it's users: the adversary/censor will have to "care about"/"look after" a way lower number of nodes... So - the explicit circuit construction by control protocol is the one and only way to construct the circuit you wish with all the custom filters.

The two-character country code according to ISO3166 can be used in either upper or lower case letters.

  • I found the local path to torrc as it has been changed a bit in Debian, see tor.stackexchange.com/questions/4018/…
    – shirish
    Commented Oct 14, 2017 at 11:49
  • I put the following, is this ok/good EntryNodes {us},{fr} ExcludeNodes {in} StrictNodes 1
    – shirish
    Commented Oct 14, 2017 at 11:50
  • well, actually - just IMHO - a -f /full/path/to/your/fully/custom/config is a must in a startup scripts: configs can be possibly overwritten even with a source-build installs. And - as for me - I'm always doing a source-builds at least for Tor to acive a way better perfomance. I can post the build settings if you need ones
    – Alexey Vesnin
    Commented Oct 14, 2017 at 11:53
  • I'm stumped by what you mean, should I make another question using your answer so you can elaborate what you mean. You will have to elaborate/show me what you mean. I can share the behavior as it happens or what I think happens in Debian and then you could elaborate on what you just shared, let me know which path/way do you prefer ?
    – shirish
    Commented Oct 14, 2017 at 11:59
  • post a link for the question here if you'll make one - I'll answer it. Now I'm going offline - so take your time
    – Alexey Vesnin
    Commented Oct 14, 2017 at 12:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .