In my torrc file, I'd like to exclude certain exit nodes from specific countries, like for example France and Germany. What's the correct syntax for this in torrc?

I've found that when I try to list multiple country codes this way for either ExcludeExitNodes or ExitNodes will result in a "Invalid exit list" warning.

For example, I've tried

ExcludeExitNodes {fr,de}
StrictNodes 1

But that gives me

Jan 09 07:16:22.308 [notice] Tor v0.2.4.23 (git-598c61362f1b3d3e) running on Windows 7 with Libevent
 2.0.21-stable and OpenSSL 1.0.1h.
Jan 09 07:16:22.308 [notice] Tor can't help you if you use it wrong! Learn how to be safe at https://www.torproject.org/download/download#warning
Jan 09 07:16:22.324 [notice] Read configuration file "G:\tor\torrc".
Jan 09 07:16:22.324 [warn] Entry '{fr' in ExitNodes is malformed.
Jan 09 07:16:22.324 [warn] Entry 'de}' in ExitNodes is malformed.
Jan 09 07:16:22.324 [warn] Failed to parse/validate config: Invalid exit list '{fr,de}' for option '
Jan 09 07:16:22.339 [err] Reading config failed--see warnings above.

While using ExcludeExitNodes {fr} works fine and successfully builds a circuit.

  • okay but most of the answers here are for multiple exit nodes by country... what about multiple exit nodes by ip?
    – woohoo
    Aug 23, 2020 at 8:42
  • Hi, please post questions as a new question rather than as an answer.
    – Steve
    Aug 23, 2020 at 17:44

2 Answers 2


The correct syntax is as follows:

ExcludeExitNodes {fr},{de},{??}

StrictNodes 1

This should work for you.

  • Please clarify whether {??} is just an example or whether it is a wildcard meaning all two-character country codes.
    – WGroleau
    Jun 3, 2016 at 9:42
  • Tor uses Maxmind’s Geo-ip lookup system for this functionality. Some of the versions of their database contain a “??” country code. This is reserved for IPs they either don’t know, or aren’t willing to share. (Source)
    – BastianW
    Oct 30, 2017 at 14:06

The right syntax in 2022 are for your sample, the follow:

ExcludeExitNodes {fr}, {de} StrictNodes 1

The follow should be more save. The additional {??} should protect you for Server whith unknown IP-country relation.

ExcludeExitNodes {fr}, {de}, {??} StrictNodes 1

The two-character country code according to ISO3166 can be used in either upper or lower case letters.

  • The {??} shouldn't be needed if you've left the GeoIPExcludeUnknown option as its default value of auto.
    – Steve
    Nov 8, 2022 at 22:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.