Use case · Tor exit relays
Why a whole machine suits a busy exit, how to set one up on Debian from the Tor Project's own guides, and how complaints are handled.
Quick answer
Can I run a Tor exit relay on a dedicated server?
Yes. You can run a Tor exit relay on a dedicated server at Ironatoll: exits are allowed, and so are middle relays and bridges. A machine that does nothing but Tor is what the Tor Project recommends for an exit. Servers cost from $63.68 per 30 days; payment is in crypto, with no KYC. Under Panamanian law, DMCA notices are ignored.
| Tor relays | Tor exit relays may run on our servers, and so may middle relays and bridges |
|---|---|
| Server | Offshore dedicated servers: a whole physical machine for you alone, with no virtualization layer and no neighbours, and full root access over SSH |
| Network | Every server has one dedicated IPv4 address and an IPv6 /64. The port speed and the monthly traffic are listed with each plan; traffic counts outgoing data per 30-day period, and over the quota there is never an automatic extra charge |
| Port 25 | Port 25 (SMTP) is blocked for outgoing traffic on every server as an anti-spam measure, and the block is permanent. Outgoing connections to mail providers on ports 465 and 587 work normally |
| Complaints | Foreign copyright notices, DMCA ones included, are set aside: we act only under Panamanian law or on a Panamanian court order. Spam, phishing, malware, botnet control, attacks and child sexual abuse material are banned, and any one of them gets the server suspended |
| Jurisdiction | Ironatoll is run by DomaineGoat LLC, a company registered in Panama, and answers only to Panamanian law. Each server’s datacenter, for its part, is bound by the law of the country it stands in |
| Logs | No logs: we keep no connection logs, no traffic logs and no IP addresses of visitors or customers, on the website, the dashboard or the servers |
| Systems | Linux only: Debian, Ubuntu, AlmaLinux, Rocky Linux, and Proxmox VE to run your own virtual machines. No Windows |
| Locations | Amsterdam (Netherlands), Reykjavik (Iceland), Zurich (Switzerland) and Bucharest (Romania); each plan is sold in each city at one price |
| Setup | A person prepares your server after your payment is confirmed, within 72 hours, so it is not instant; your dashboard shows the status, then the IP address once the server is ready |
| Identity | No KYC: no ID, selfie, documents, card or phone number are ever collected |
| Price per 30 days | Atoll 16 $63.68, Atoll 32 $72.15, Atoll 64 $72.62, Atoll 128 $205.27, Atoll 256 $406.37 |
A dedicated server suits a busy exit because its CPU, RAM and port serve Tor alone. The Tor Project's exit setup page asks for exactly that: exits on machines dedicated to the purpose, never mixed with your own traffic.
A Tor exit relay is the last hop of a Tor circuit: the website sees its IP address, not the user's. That is why exits draw complaints, and why a separate machine with its own address is the clean setup.
The Tor Project's relay requirements give the sizing:
aes in /proc/cpuinfo.Every Ironatoll server has one dedicated IPv4 address, so the ceiling is eight exit instances. At 1.5 GB each, they need 12 GB, which fits in the 16 GB of the smallest plan. On a dedicated server, the port and the traffic quota limit a Tor exit long before the RAM does.
Ironatoll does, on every plan: Tor exit relays may run on our servers, and so may middle relays and bridges. According to Ironatoll's check of 30 October 2026, 4 of 34 dedicated-server hosts allow Tor exit relays. The page on which hosting providers allow Tor exit nodes lists them with each host's own wording.
An exit sends about as much as it receives, so its average rate sets its monthly traffic, and every plan's quota counts outgoing data only.
A Tor exit that averages 100 Mbit/s sends about 32.4 TB in 30 days. Tor's floor for any relay is 10 Mbit/s, with 100 GB moved each way per month. Its advice is over 2 TB a month, ideally unmetered. See what unmetered bandwidth means on a dedicated server.
| Average rate | Outgoing data in 30 days | What it means |
|---|---|---|
| 10 Mbit/s | 3.24 TB | The minimum Tor sets for every relay |
| 100 Mbit/s | 32.4 TB | What the Tor Project calls a fast exit |
| 400 Mbit/s | 129.6 TB | About one Tor instance at full speed with AES-NI |
| 1 Gbit/s | 324 TB | Several instances filling a 1 Gbit/s port |
Each figure is the rate × 2,592,000 seconds ÷ 8, counting 1 TB as 10^12 bytes. These are averages over 30 days, not peaks, and a calculation, not a measurement.
| Plan | Price per 30 days | Server | Traffic |
|---|---|---|---|
| Atoll 16 | $63.68 | Intel Xeon E-2236 (6 cores / 12 threads), 16 GB RAM, 2 × 480 GB SSD in RAID 1, 30 TB a month at 1 Gbit/s, 1 IPv4 and an IPv6 /64 | 30 TB a month at 1 Gbit/s |
| Atoll 32 | $72.15 | AMD Ryzen 5 5600 (6 cores / 12 threads), 32 GB RAM, 2 × 512 GB NVMe in RAID 1, 40 TB a month at 1 Gbit/s, 1 IPv4 and an IPv6 /64 | 40 TB a month at 1 Gbit/s |
| Atoll 64 | $72.62 | Intel Xeon E-2288G (8 cores / 16 threads), 64 GB RAM, 2 × 960 GB NVMe in RAID 1, 60 TB a month at 1 Gbit/s, 1 IPv4 and an IPv6 /64 | 60 TB a month at 1 Gbit/s |
| Atoll 128 | $205.27 | AMD Ryzen 9 7950X (16 cores / 32 threads), 128 GB RAM, 2 × 1.92 TB NVMe in RAID 1, 100 TB a month at 1 Gbit/s, 1 IPv4 and an IPv6 /64 | 100 TB a month at 1 Gbit/s |
| Atoll 256 | $406.37 | AMD EPYC 7443P (24 cores / 48 threads), 256 GB RAM, 2 × 3.84 TB NVMe in RAID 1, 150 TB a month at 1 Gbit/s, 1 IPv4 and an IPv6 /64 | 150 TB a month at 1 Gbit/s |
Keep Tor under your quota. RelayBandwidthRate caps the average rate. AccountingMax caps the bytes in a period, and AccountingStart day 00:00 makes that period one day. A daily budget of one thirtieth of the quota keeps the exit inside it.
These steps follow three Tor Project pages, read on 30 October 2026: the Debian relay guide, the repository page and the exit page. Run them as root.
Update Debian and turn on automatic updates
Log in with your SSH key and run apt update && apt full-upgrade. The Tor Project asks relay operators to enable automatic security updates, for example with unattended-upgrades.
Add the Tor Project's package repository
Check that dpkg --print-architecture says amd64 or arm64. Then add deb.torproject.org for your Debian codename, with its signing key, as the Tor Project's repository page shows.
Install Tor
Refresh the package lists with apt update, then run apt install tor deb.torproject.org-keyring. The keyring package keeps the signing key current.
Run your own DNS resolver
Exits look up names for Tor users. Install Unbound as a local, caching, DNSSEC-validating resolver with no forwarders, and point /etc/resolv.conf to it. Avoid big public resolvers such as Google, Cloudflare, Quad9 and OpenDNS.
Write the exit configuration
Edit /etc/tor/torrc as in the example below: a nickname, a working ContactInfo, ORPort 443, ExitRelay 1 and ReducedExitPolicy 1.
Publish an exit notice
Serve a short page on port 80 of your IP that says the address is a Tor exit. The Tor Project provides an HTML template. DirPort has been deprecated since Tor 0.4.6.5, so a small web server does the job.
Restart and check
Run systemctl restart tor@default and read the log with journalctl -u tor@default. Then look your relay up by nickname on Relay Search, at metrics.torproject.org.
ExitRelay 1 turns a relay into an exit, ReducedExitPolicy 1 limits its ports, and the accounting lines cap its traffic. The example keeps traffic near 1 TB a day.
# Identity: Tor publishes both lines in the relay directory
Nickname atollExit01
ContactInfo [email protected]
# Exit role and ports
ExitRelay 1
ReducedExitPolicy 1 # ~65 destination ports, 25 excluded
IPv6Exit 1 # uses the server's IPv6 /64
ORPort 443
SocksPort 0 # no local client on the exit
# Traffic cap: ~1 TB a day, so ~30 TB per 30-day period
AccountingStart day 00:00
AccountingMax 1 TBytes
# Then: systemctl restart tor@defaultRunning several instances? Declare them as one family, with MyFamily or the newer FamilyId, so no client uses two of them in one circuit. Set ContactInfo to a working address: the Tor manual requires it as soon as you run more than one relay.
Start with the reduced exit policy. The Tor manual says ReducedExitPolicy 1 allows about 65 ports while blocking most TCP ports. It keeps 22, 80, 443, 465 and 587, and it leaves out 25. The Tor Project tells new exit operators to start there and open more ports with experience.
An exit must at least allow ports 80 and 443 to be useful. Tor's default exit policy already begins with reject *:25. That fits our own network rule, which shuts outgoing port 25 on all Ironatoll servers.
A copyright notice aimed at your exit leads to no action from Ironatoll. Our position: Foreign copyright notices, DMCA ones included, are set aside: we act only under Panamanian law or on a Panamanian court order. Spam, phishing, malware, botnet control, attacks and child sexual abuse material are banned, and any one of them gets the server suspended. Read what DMCA ignored means for a dedicated server for the rule itself.
Your server's datacenter answers to the law of its own country. So the Tor Project's advice to cut complaints is worth following:
tor-exit, under a domain of your own. Custom reverse DNS is not among Ironatoll's published promises, so ask support before you order if you need it.Before you start, read whether it is legal to run a Tor exit node.
Exits, middle relays and bridges run on any plan. Compare all five plans on how much an Ironatoll dedicated server costs, or see the best offshore dedicated server providers.
6 cores · 16 GB RAM
$63.68
3 months $171.93 (−10%)6 months $305.66 (−20%)1 year $534.91 (−30%)
6 cores · 32 GB RAM
$72.15
3 months $194.80 (−10%)6 months $346.32 (−20%)1 year $606.06 (−30%)
Best value
8 cores · 64 GB RAM
$72.62
3 months $196.07 (−10%)6 months $348.57 (−20%)1 year $610 (−30%)
In every plan: Whole machine · Root access · RAID 1 on two disks · Dedicated IPv4 · No logs · No KYC
A Tor exit node is the relay that connects a Tor circuit to the open internet. Websites see its IP address, not the user's. Guard and middle relays only pass encrypted traffic between relays.
Plan on 1.5 GB for each exit instance, as the Tor Project advises. Eight instances, the most one IPv4 address may carry, need 12 GB. Even the smallest Ironatoll plan has 16 GB.
The Tor Project and EFF advise against it. Complaints and police questions about exit traffic would point to your home address. A rented server in a datacenter keeps the exit apart from your own connection.
No. Monero is not among the coins Ironatoll takes: BTC, USDT, USDC, ETH, SOL, LTC. Whatever the coin, the order needs no ID and no KYC check.
Run your exit on a whole machine
Atoll 16: Intel Xeon E-2236 (6 cores / 12 threads), 16 GB RAM, 2 × 480 GB SSD in RAID 1, 30 TB a month at 1 Gbit/s, 1 IPv4 and an IPv6 /64, for $63.68 per 30 days. Exits allowed; pay in crypto, no KYC.
From $63.68/30 days · no KYC
Get a dedicated server