I noticed that when using iptables_torify to force connections through TOR that .onion addresses are mapped to local virtual IPs in the 10.66.x.x range. This is indicated in the torrc file:

AutomapHostsOnResolve 1

Unfortunately, TOR is constantly assigning different IPs to the same hidden service which is causing a few problems. For example:

Whenever I use my local ssh client to connect to a hidden service I get some kind of message like:

The authenticity of host 'blahblahblahblah.onion (' can't be established. ECDSA key fingerprint is 0a:1b:2c:..... Are you sure you want to continue connecting (yes/no)?

Now if I click yes all is good until next time I reboot the computer I get the same message again with a different address (eg: Sometimes I get an address that was already used for a different hidden service and I have to go to ~/.ssh/know_keys to delete the line in question before I can connect.

I really need to be able to just tell tor to permanently map address blahblahblah.onion to let's say That way I could just ssh and have the ssh fingerprint for listed once and for all in my ~/.ssh/knownhosts file.

Thank you Linostar for suggesting:

ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no user@host

However SSH is only one of my problems that I showed for illustration purposes. And actually I would like to use the .ssh/known_keys file to verify the keys of the servers I'm connecting to rather than just blindly connecting to the server.

I also need to use other programs that may only give the option of specifying an IP address for outgoing connections. For example, if I want to tell FireFox to connect to a proxy server (the proxy server has a .onion address). I'm sure there's a work around for that too but just specifying the ip address would be a lot simpler for me.

Anyway, I don't want to rely on iptables to send DNS requests to TOR when it would be a lot simpler and more secure to just specify the ip address of the hidden service. On some servers I'm unable to configure iptables anyway. And I don't want to take the risk of a DNS leak in case I made an error configuring iptables or if the configuration was changed without my knowledge.

All that to say that mapping an .onion address to a specific IP would be a very important benefit that would save a lot of trouble for nothing. Hopefully somebody has a solution!

  • You should be able to use an onion address as a proxy in Firefox. Remember that local virtual IP addresses are meant to be temporary, and the benefits from making them static can be found elsewhere (or so I think).
    – Linostar
    Jan 31, 2015 at 11:34

1 Answer 1


I am not aware of any method to map .onion addresses to local IP addresses like you described, so I am going to propose an alternative approach.

When connecting to an onion SSH service, use the following command syntax:

ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no user@host

That will make ssh bypass the KnownHosts files and not ask for fingerprint checking anymore, which is kind of useless when you have an ever-varying service IP address.

To make things easier, you can make an alias of the command above. For example:

alias sshtor='ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no'

and place that alias line in your ~/.bashrc, so you can connect to onion SSH servers by typing:

sshtor user@host

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.