How do I run a Monero node over Tor?

You can run a Monero node over Tor by installing Tor and telling monerod, the Monero node program, to use its local proxy. Be careful: Monero’s --tx-proxy setting only routes transaction broadcasts over Tor; it does not put all your node’s network traffic through Tor.

Install Tor and check your node

Use an up-to-date Monero release from the official project. A node downloads and checks the blockchain—the shared record of Monero transactions—so allow enough disk space and time for the first sync.

Install Tor using your operating system’s trusted software packages, then start its background service.

Tor usually offers a SOCKS proxy, a local connection that sends traffic through Tor, at:

127.0.0.1:9050

127.0.0.1 means your own computer. Tor Browser commonly uses port 9150 instead, but a separate Tor service is better suited to an always-running node.

Check your Monero version’s available settings:

monerod --help

Look for --proxy, --tx-proxy, and --anonymous-inbound. If --proxy is missing, update before following the full-traffic setup below.

Route outgoing node connections through Tor

With a current version that supports --proxy, a basic starting command is:

monerod \
  --proxy 127.0.0.1:9050 \
  --p2p-bind-ip 127.0.0.1 \
  --rpc-bind-ip 127.0.0.1 \
  --no-igd \
  --hide-my-port \
  --disable-dns-checkpoints \
  --check-updates disabled

Here is what matters:

• --proxy sends outgoing peer connections through Tor, including connections used to sync the blockchain.
• --p2p-bind-ip keeps the normal incoming peer listener local.
• --rpc-bind-ip keeps the wallet-control interface, called RPC, local.
• --no-igd prevents automatic router port forwarding.
• --hide-my-port stops your node from advertising its normal listening port.
• The last two settings disable DNS-based checkpoint lookups and automatic update checks. You must check for updates yourself.

Tor does not automatically protect every program or every kind of network request. Peer discovery can also involve DNS—lookups that turn names into network addresses. If preventing any direct connection is essential, use a properly configured Tor-only gateway or firewall as well, rather than relying on node flags alone.

Add an onion address for incoming peers

Outgoing connections are enough to run a node. To accept incoming connections over Tor too, add an onion service, an address reachable through Tor.

On a typical Linux installation, add this to Tor’s configuration file, usually called torrc:

HiddenServiceDir /var/lib/tor/monero/
HiddenServicePort 18083 127.0.0.1:18083

Restart Tor. Read the generated hostname file inside that directory, then add this option when starting monerod:

--anonymous-inbound YOUR_ADDRESS.onion:18083,127.0.0.1:18083

Replace YOUR_ADDRESS.onion with the actual address. Keep the onion-service private keys secret. You do not need to open a router port for this service.

Check the setup and protect local access

Check your node’s logs and connection status. Syncing over Tor can be noticeably slower.

Keep RPC private. If your wallet, solo miner, or P2Pool runs on the same computer, it can normally connect locally. Remember that P2Pool has its own peer connections: putting monerod behind Tor does not automatically route P2Pool through Tor.

The bottom line

Use --proxy for outgoing node traffic, and optionally add an onion service for incoming peers. Keep RPC local, verify your actual connections, and do not mistake transaction-only proxying for a fully Tor-routed node.