I have set up a relay with its own dynamic public IP directly on the Internet. The only port allowed on the public interface is the ORPort, and this is the way I want to keep it. However, it would be beneficial to also let this relay be reachable from my private network for management purposes. I would like both SSH and Control Port. The relay should not have Internet access through the private network.

What is the best way to achieve this? Are there security concerns with this setup?


  • Is a router an option? Sounds like what you need is the local IP for management.
    – Birb
    Jan 6, 2020 at 21:24

2 Answers 2


Recommendation: SSH over Tor. Create an v3 onion service for SSH. This will reduce your attack surface to only allow connections from Tor but not from the internet. Best practice for SSH security is to use a key to log in and not a password. Also, you can have SSH run on 2222 or some random port instead of the standard port 22 to further hide that it is actually out there.

The negative is that SSH over Tor is noticeable laggy. Not to the point of being unusable, but to the point that it can be really irritating if you are expecting a near instantaneous response time.

  • Using single hop hidden service may improve the lag a bit. It has to be noted however that this comes with a cost of service no longer being anonymous (which may be acceptable in this case).
    – Tomek
    Jan 4, 2020 at 14:12
  • Thanks for the recommendation, but according to Tor itself this is not a good practice. When I try to configure a hidden SSH service on my relay to manage it, Tor throws this warning during startup: [warn] Tor is currently configured as a relay and a hidden service. That's not very secure: you should probably run your hidden service in a separate Tor process, at least -- see https://trac.torproject.org/8742 Any comments to this? Jan 5, 2020 at 0:53

ControlPort is not so safe to be opened just by itself even in a private network, but a STunnel with a strict local CA and certificate verification solves this problem easily. SSH port can be opened to your private network, but for public network just make a hidden service for it with the client key to avoid the service guessing and corresponding attack vectors

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .