I have set up a relay with its own dynamic public IP directly on the Internet. The only port allowed on the public interface is the ORPort, and this is the way I want to keep it. However, it would be beneficial to also let this relay be reachable from my private network for management purposes. I would like both SSH and Control Port. The relay should not have Internet access through the private network.

What is the best way to achieve this? Are there security concerns with this setup?


  • Is a router an option? Sounds like what you need is the local IP for management. – Birb Jan 6 at 21:24

Recommendation: SSH over Tor. Create an v3 onion service for SSH. This will reduce your attack surface to only allow connections from Tor but not from the internet. Best practice for SSH security is to use a key to log in and not a password. Also, you can have SSH run on 2222 or some random port instead of the standard port 22 to further hide that it is actually out there.

The negative is that SSH over Tor is noticeable laggy. Not to the point of being unusable, but to the point that it can be really irritating if you are expecting a near instantaneous response time.

| improve this answer | |
  • Using single hop hidden service may improve the lag a bit. It has to be noted however that this comes with a cost of service no longer being anonymous (which may be acceptable in this case). – Tomek Jan 4 at 14:12
  • Thanks for the recommendation, but according to Tor itself this is not a good practice. When I try to configure a hidden SSH service on my relay to manage it, Tor throws this warning during startup: [warn] Tor is currently configured as a relay and a hidden service. That's not very secure: you should probably run your hidden service in a separate Tor process, at least -- see https://trac.torproject.org/8742 Any comments to this? – Morgan Simonsen Jan 5 at 0:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.