-
AllowInvalidNodes entry|exit|middle|introduction|rendezvous|…
-
If some Tor servers are obviously not working right, the directory
authorities can manually mark them as invalid, meaning that it's not
recommended you use them for entry or exit positions in your circuits. You
can opt to use them in some circuit positions, though. The default is
"middle,rendezvous", and other choices are not advised.
-
ExcludeSingleHopRelays 0|1
-
This option controls whether circuits built by Tor will include relays with
the AllowSingleHopExits flag set to true. If ExcludeSingleHopRelays is set
to 0, these relays will be included. Note that these relays might be at
higher risk of being seized or observed, so they are not normally
included. Also note that relatively few clients turn off this option,
so using these relays might make your client stand out.
(Default: 1)
-
Bridge IP:ORPort [fingerprint]
-
When set along with UseBridges, instructs Tor to use the relay at
"IP:ORPort" as a "bridge" relaying into the Tor network. If "fingerprint"
is provided (using the same format as for DirServer), we will verify that
the relay running at that location has the right fingerprint. We also use
fingerprint to look up the bridge descriptor at the bridge authority, if
it's provided and if UpdateBridgesFromAuthority is set too.
-
LearnCircuitBuildTimeout 0|1
-
If 0, CircuitBuildTimeout adaptive learning is disabled. (Default: 1)
-
CircuitBuildTimeout NUM
-
Try for at most NUM seconds when building circuits. If the circuit isn't
open in that time, give up on it. If LearnCircuitBuildTimeout is 1, this
value serves as the initial value to use before a timeout is learned. If
LearnCircuitBuildTimeout is 0, this value is the only value used.
(Default: 60 seconds.)
-
CircuitIdleTimeout NUM
-
If we have kept a clean (never used) circuit around for NUM seconds, then
close it. This way when the Tor client is entirely idle, it can expire all
of its circuits, and then expire its TLS connections. Also, if we end up
making a circuit that is not useful for exiting any of the requests we're
receiving, it won't forever take up a slot in the circuit list. (Default: 1
hour.)
-
CircuitStreamTimeout NUM
-
If non-zero, this option overrides our internal timeout schedule for how
many seconds until we detach a stream from a circuit and try a new circuit.
If your network is particularly slow, you might want to set this to a
number like 60. (Default: 0)
-
ClientOnly 0|1
-
If set to 1, Tor will under no circumstances run as a server or serve
directory requests. The default is to run as a client unless ORPort is
configured. (Usually, you don't need to set this; Tor is pretty smart at
figuring out whether you are reliable and high-bandwidth enough to be a
useful server.) (Default: 0)
-
ExcludeNodes node,node,…
-
A list of identity fingerprints, nicknames, country codes and address
patterns of nodes to avoid when building a circuit.
(Example:
ExcludeNodes SlowServer, $ EFFFFFFFFFFFFFFF, {cc}, 255.254.0.0/8)
By default, this option is treated as a preference that Tor is allowed
to override in order to keep working.
For example, if you try to connect to a hidden service,
but you have excluded all of the hidden service's introduction points,
Tor will connect to one of them anyway. If you do not want this
behavior, set the StrictNodes option (documented below). +
Note also that if you are a relay, this (and the other node selection
options below) only affects your own circuits that Tor builds for you.
Clients can still build circuits through you to any node. Controllers
can tell Tor to build circuits through any node.
-
ExcludeExitNodes node,node,…
-
A list of identity fingerprints, nicknames, country codes and address
patterns of nodes to never use when picking an exit node---that is, a
node that delivers traffic for you outside the Tor network. Note that any
node listed in ExcludeNodes is automatically considered to be part of this
list too. See also the caveats on the "ExitNodes" option below.
-
ExitNodes node,node,…
-
A list of identity fingerprints, nicknames, country codes and address
patterns of nodes to use as exit node---that is, a
node that delivers traffic for you outside the Tor network.
Note that if you list too few nodes here, or if you exclude too many exit
nodes with ExcludeExitNodes, you can degrade functionality. For example,
if none of the exits you list allows traffic on port 80 or 443, you won't
be able to browse the web. +
Note also that not every circuit is used to deliver traffic outside of
the Tor network. It is normal to see non-exit circuits (such as those
used to connect to hidden services, those that do directory fetches,
those used for relay reachability self-tests, and so on) that end
at a non-exit node. To
keep a node from being used entirely, see ExcludeNodes and StrictNodes. +
The ExcludeNodes option overrides this option: any node listed in both
ExitNodes and ExcludeNodes is treated as excluded. +
The .exit address notation, if enabled via AllowDotExit, overrides
this option.
-
EntryNodes node,node,…
-
A list of identity fingerprints and nicknames of nodes
to use for the first hop in your normal circuits. (Country codes and
address patterns are not yet supported.) Normal circuits include all
circuits except for direct connections to directory servers. The Bridge
option overrides this option; if you have configured bridges and
UseBridges is 1, the Bridges are used as your entry nodes.
The ExcludeNodes option overrides this option: any node listed in both
EntryNodes and ExcludeNodes is treated as excluded.
-
StrictNodes 0|1
-
If StrictNodes is set to 1, Tor will treat the ExcludeNodes option as a
requirement to follow for all the circuits you generate, even if doing so
will break functionality for you. If StrictNodes is set to 0, Tor will
still try to avoid nodes in the ExcludeNodes list, but it will err on the
side of avoiding unexpected errors. Specifically, StrictNodes 0 tells
Tor that it is okay to use an excluded node when it is necessary to
perform relay reachability self-tests, connect to
a hidden service, provide a hidden service to a client, fulfill a .exit
request, upload directory information, or download directory information.
(Default: 0)
-
FascistFirewall 0|1
-
If 1, Tor will only create outgoing connections to ORs running on ports
that your firewall allows (defaults to 80 and 443; see FirewallPorts).
This will allow you to run Tor as a client behind a firewall with
restrictive policies, but will not allow you to run as a server behind such
a firewall. If you prefer more fine-grained control, use
ReachableAddresses instead.
-
FirewallPorts PORTS
-
A list of ports that your firewall allows you to connect to. Only used when
FascistFirewall is set. This option is deprecated; use ReachableAddresses
instead. (Default: 80, 443)
-
HidServAuth onion-address auth-cookie [service-name]
-
Client authorization for a hidden service. Valid onion addresses contain 16
characters in a-z2-7 plus ".onion", and valid auth cookies contain 22
characters in A-Za-z0-9+/. The service name is only used for internal
purposes, e.g., for Tor controllers. This option may be used multiple times
for different hidden services. If a hidden service uses authorization and
this option is not set, the hidden service is not accessible. Hidden
services can be configured to require authorization using the
HiddenServiceAuthorizeClient option.
-
ReachableAddresses ADDR[/MASK][:PORT]…
-
A comma-separated list of IP addresses and ports that your firewall allows
you to connect to. The format is as for the addresses in ExitPolicy, except
that "accept" is understood unless "reject" is explicitly provided. For
example, 'ReachableAddresses 99.0.0.0/8, reject 18.0.0.0/8:80, accept
*:80' means that your firewall allows connections to everything inside net
99, rejects port 80 connections to net 18, and accepts connections to port
80 otherwise. (Default: 'accept *:*'.)
-
ReachableDirAddresses ADDR[/MASK][:PORT]…
-
Like ReachableAddresses, a list of addresses and ports. Tor will obey
these restrictions when fetching directory information, using standard HTTP
GET requests. If not set explicitly then the value of
ReachableAddresses is used. If HTTPProxy is set then these
connections will go through that proxy.
-
ReachableORAddresses ADDR[/MASK][:PORT]…
-
Like ReachableAddresses, a list of addresses and ports. Tor will obey
these restrictions when connecting to Onion Routers, using TLS/SSL. If not
set explicitly then the value of ReachableAddresses is used. If
HTTPSProxy is set then these connections will go through that proxy.
The separation between ReachableORAddresses and
ReachableDirAddresses is only interesting when you are connecting
through proxies (see HTTPProxy and HTTPSProxy). Most proxies limit
TLS connections (which Tor uses to connect to Onion Routers) to port 443,
and some limit HTTP GET requests (which Tor uses for fetching directory
information) to port 80.
-
LongLivedPorts PORTS
-
A list of ports for services that tend to have long-running connections
(e.g. chat and interactive shells). Circuits for streams that use these
ports will contain only high-uptime nodes, to reduce the chance that a node
will go down before the stream is finished. (Default: 21, 22, 706, 1863,
5050, 5190, 5222, 5223, 6667, 6697, 8300)
-
MapAddress address newaddress
-
When a request for address arrives to Tor, it will rewrite it to newaddress
before processing it. For example, if you always want connections to
www.indymedia.org to exit via torserver (where torserver is the
nickname of the server), use "MapAddress www.indymedia.org
www.indymedia.org.torserver.exit".
-
NewCircuitPeriod NUM
-
Every NUM seconds consider whether to build a new circuit. (Default: 30
seconds)
-
MaxCircuitDirtiness NUM
-
Feel free to reuse a circuit that was first used at most NUM seconds ago,
but never attach a new stream to a circuit that is too old. (Default: 10
minutes)
-
NodeFamily node,node,…
-
The Tor servers, defined by their identity fingerprints or nicknames,
constitute a "family" of similar or co-administered servers, so never use
any two of them in the same circuit. Defining a NodeFamily is only needed
when a server doesn't list the family itself (with MyFamily). This option
can be used multiple times.
-
EnforceDistinctSubnets 0|1
-
If 1, Tor will not put two servers whose IP addresses are "too close" on
the same circuit. Currently, two addresses are "too close" if they lie in
the same /16 range. (Default: 1)
-
SocksPort PORT|auto
-
Advertise this port to listen for connections from Socks-speaking
applications. Set this to 0 if you don't want to allow application
connections via SOCKS. Set it to "auto" to have Tor pick a port for
you. (Default: 9050)
-
SocksListenAddress IP[:PORT]
-
Bind to this address to listen for connections from Socks-speaking
applications. (Default: 127.0.0.1) You can also specify a port (e.g.
192.168.0.1:9100). This directive can be specified multiple times to bind
to multiple addresses/ports.
-
SocksPolicy policy,policy,…
-
Set an entrance policy for this server, to limit who can connect to the
SocksPort and DNSPort ports. The policies have the same form as exit
policies below.
-
SocksTimeout NUM
-
Let a socks connection wait NUM seconds handshaking, and NUM seconds
unattached waiting for an appropriate circuit, before we fail it. (Default:
2 minutes.)
-
TrackHostExits host,.domain,…
-
For each value in the comma separated list, Tor will track recent
connections to hosts that match this value and attempt to reuse the same
exit node for each. If the value is prepended with a '.', it is treated as
matching an entire domain. If one of the values is just a '.', it means
match everything. This option is useful if you frequently connect to sites
that will expire all your authentication cookies (i.e. log you out) if
your IP address changes. Note that this option does have the disadvantage
of making it more clear that a given history is associated with a single
user. However, most people who would wish to observe this will observe it
through cookies or other protocol-specific means anyhow.
-
TrackHostExitsExpire NUM
-
Since exit servers go up and down, it is desirable to expire the
association between host and exit server after NUM seconds. The default is
1800 seconds (30 minutes).
-
UpdateBridgesFromAuthority 0|1
-
When set (along with UseBridges), Tor will try to fetch bridge descriptors
from the configured bridge authorities when feasible. It will fall back to
a direct request if the authority responds with a 404. (Default: 0)
-
UseBridges 0|1
-
When set, Tor will fetch descriptors for each bridge listed in the "Bridge"
config lines, and use these relays as both entry guards and directory
guards. (Default: 0)
-
UseEntryGuards 0|1
-
If this option is set to 1, we pick a few long-term entry servers, and try
to stick with them. This is desirable because constantly changing servers
increases the odds that an adversary who owns some servers will observe a
fraction of your paths. (Defaults to 1.)
-
NumEntryGuards NUM
-
If UseEntryGuards is set to 1, we will try to pick a total of NUM routers
as long-term entries for our circuits. (Defaults to 3.)
-
SafeSocks 0|1
-
When this option is enabled, Tor will reject application connections that
use unsafe variants of the socks protocol — ones that only provide an IP
address, meaning the application is doing a DNS resolve first.
Specifically, these are socks4 and socks5 when not doing remote DNS.
(Defaults to 0.)
-
TestSocks 0|1
-
When this option is enabled, Tor will make a notice-level log entry for
each connection to the Socks port indicating whether the request used a
safe socks protocol or an unsafe one (see above entry on SafeSocks). This
helps to determine whether an application using Tor is possibly leaking
DNS requests. (Default: 0)
-
WarnUnsafeSocks 0|1
-
When this option is enabled, Tor will warn whenever a request is
received that only contains an IP address instead of a hostname. Allowing
applications to do DNS resolves themselves is usually a bad idea and
can leak your location to attackers. (Default: 1)
-
VirtualAddrNetwork Address/bits
-
When Tor needs to assign a virtual (unused) address because of a MAPADDRESS
command from the controller or the AutomapHostsOnResolve feature, Tor
picks an unassigned address from this range. (Default:
127.192.0.0/10)
When providing proxy server service to a network of computers using a tool
like dns-proxy-tor, change this address to "10.192.0.0/10" or
"172.16.0.0/12". The default VirtualAddrNetwork address range on a
properly configured machine will route to the loopback interface. For
local use, no change to the default VirtualAddrNetwork setting is needed.
-
AllowNonRFC953Hostnames 0|1
-
When this option is disabled, Tor blocks hostnames containing illegal
characters (like @ and :) rather than sending them to an exit node to be
resolved. This helps trap accidental attempts to resolve URLs and so on.
(Default: 0)
-
AllowDotExit 0|1
-
If enabled, we convert "www.google.com.foo.exit" addresses on the
SocksPort/TransPort/NATDPort into "www.google.com" addresses that exit from
the node "foo". Disabled by default since attacking websites and exit
relays can use it to manipulate your path selection. (Default: 0)
-
FastFirstHopPK 0|1
-
When this option is disabled, Tor uses the public key step for the first
hop of creating circuits. Skipping it is generally safe since we have
already used TLS to authenticate the relay and to establish forward-secure
keys. Turning this option off makes circuit building slower.
Note that Tor will always use the public key step for the first hop if it's
operating as a relay, and it will never use the public key step if it
doesn't yet know the onion key of the first hop. (Default: 1)
-
TransPort PORT|auto
-
If non-zero, enables transparent proxy support on PORT (by convention,
9040). Requires OS support for transparent proxies, such as BSDs' pf or
Linux's IPTables. If you're planning to use Tor as a transparent proxy for
a network, you'll want to examine and change VirtualAddrNetwork from the
default setting. You'll also want to set the TransListenAddress option for
the network you'd like to proxy. Set it to "auto" to have Tor pick a
port for you. (Default: 0).
-
TransListenAddress IP[:PORT]
-
Bind to this address to listen for transparent proxy connections. (Default:
127.0.0.1). This is useful for exporting a transparent proxy server to an
entire network.
-
NATDPort PORT|auto
-
Allow old versions of ipfw (as included in old versions of FreeBSD, etc.)
to send connections through Tor using the NATD protocol. This option is
only for people who cannot use TransPort. Set it to "auto" to have Tor
pick a port for you. (Default: 0)
-
NATDListenAddress IP[:PORT]
-
Bind to this address to listen for NATD connections. (Default: 127.0.0.1).
-
AutomapHostsOnResolve 0|1
-
When this option is enabled, and we get a request to resolve an address
that ends with one of the suffixes in AutomapHostsSuffixes, we map an
unused virtual address to that address, and return the new virtual address.
This is handy for making ".onion" addresses work with applications that
resolve an address and then connect to it. (Default: 0).
-
AutomapHostsSuffixes SUFFIX,SUFFIX,…
-
A comma-separated list of suffixes to use with AutomapHostsOnResolve.
The "." suffix is equivalent to "all addresses." (Default: .exit,.onion).
-
DNSPort PORT|auto
-
If non-zero, Tor listens for UDP DNS requests on this port and resolves
them anonymously. Set it to "auto" to have Tor pick a port for
you. (Default: 0).
-
DNSListenAddress IP[:PORT]
-
Bind to this address to listen for DNS connections. (Default: 127.0.0.1).
-
ClientDNSRejectInternalAddresses 0|1
-
If true, Tor does not believe any anonymously retrieved DNS answer that
tells it that an address resolves to an internal address (like 127.0.0.1 or
192.168.0.1). This option prevents certain browser-based attacks; don't
turn it off unless you know what you're doing. (Default: 1).
-
ClientRejectInternalAddresses 0|1
-
If true, Tor does not try to fulfill requests to connect to an internal
address (like 127.0.0.1 or 192.168.0.1) unless a exit node is
specifically requested (for example, via a .exit hostname, or a
controller request). (Default: 1).
-
DownloadExtraInfo 0|1
-
If true, Tor downloads and caches "extra-info" documents. These documents
contain information about servers other than the information in their
regular router descriptors. Tor does not use this information for anything
itself; to save bandwidth, leave this option turned off. (Default: 0).
-
FallbackNetworkstatusFile FILENAME
-
If Tor doesn't have a cached networkstatus file, it starts out using this
one instead. Even if this file is out of date, Tor can still use it to
learn about directory mirrors, so it doesn't need to put load on the
authorities. (Default: None).
-
WarnPlaintextPorts port,port,…
-
Tells Tor to issue a warnings whenever the user tries to make an anonymous
connection to one of these ports. This option is designed to alert users
to services that risk sending passwords in the clear. (Default:
23,109,110,143).
-
RejectPlaintextPorts port,port,…
-
Like WarnPlaintextPorts, but instead of warning about risky port uses, Tor
will instead refuse to make the connection. (Default: None).
-
AllowSingleHopCircuits 0|1
-
When this option is set, the attached Tor controller can use relays
that have the AllowSingleHopExits option turned on to build
one-hop Tor connections. (Default: 0)