I'm trying to setup Tor Exit Node but I'm behind CG-NAT. I came across the idea of port-forwarding my local ORPort to a VPS which has Public IP and is accessible to world.

For communication between my local PC (hosting Tor node) and VPS, I use tailscale which just works out of the box. I installed tailscale on both devices and ORPort is accessible to VPS. Here is the diagram to simplify it:

enter image description here

To make TOR work, the port must be accessible publicly on given Public IP. It fails to do Self-check. Below is the diagram depicting expected behavior

enter image description here

I have tired setting up Nginx, Envoy, iptables, socat on VPS but none of them seem to work with ORPort


socat TCP-LISTEN:9029,fork,reuseaddr TCP:


iptables -I FORWARD -d -m tcp -p tcp --dport 9029 -j ACCEPT 
iptables -t nat -I PREROUTING -m tcp -p tcp ! -i tailscale0 --dport 9029 -j DNAT --to-destination
iptables -t nat -I POSTROUTING -d -o tailscale0 -j MASQUERADE

I feel port-forwarding is working but something is there in ORPort maybe a security thing that is not allowing it to accept connections.

I know that there is no configuration issue because the same works if I directly run on VPS. It is configured to accept traffic from


I tried reducing the route to find the root cause of it. I'm running tor on VPS along with haproxy. When I put haproxy port for advertising, self-check doesn't pass. However, if I start advertising tor's actual orport then it passes. What a weird behavior. From tcpdump, I can see tor is receiving connection in both conditions but haproxy is just not passing.

I'm stuck on it for over a week. Any help will be appreciated 🙂

2 Answers 2


Try setting the Address option in your torrc file to the public address of your VPS. From the tor man page:

Address address
     The IPv4 address of this server, or a fully qualified domain name of this server that resolves to an IPv4 address. You can leave this unset, and
     Tor will try to guess your IPv4 address. This IPv4 address is the one used to tell clients and other servers where to find your Tor server; it
     doesn’t affect the address that your server binds to. To bind to a different address, use the ORPort and OutboundBindAddress options.
  • 1
    That is set already and doesn't work. Sep 17, 2021 at 5:27

Tailscale is not the right choice to do it out of the box and you need it vice versa: you need to use OpenVPN from your NAT'ed box to the VPS and the client here should be a NAT'ed box. After that just forward the port VPS->NATed via static OpenVPN internal IP's and make the NAT for tor process user through the VPN tunnel. Then self-check will succeed and everything else will work out of the box. Don't forget to bind ORPort to the VPN internal IP and set the external address of your VPS server in your torrc !

  • I can give a try to openvpn but why is tailscale not right for this ? I want my tor traffic to come out of PC, only incoming connection should enter for VPS Sep 17, 2021 at 22:52
  • To achieve this you will need to specify the exit address/interface in Tor config, but moving traffic both ways is essential for self-test and other tor activities to work properly: you will have the tor network connectivity via your VPS but exit traffic will be via NATed PC. Tailscale is a noob-grade VPN software for those who can not config the right one and it misses the depth of configurability of OpenVPN
    – Alexey Vesnin
    Sep 18, 2021 at 6:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .