I would like to get Bitcoind to advertise that it is listening on an onion address. However, I do not want to have Bitcoind use a tor socks proxy to connect. I have a special router for tor connections and the Bitcoind server uses that as its network gateway. How do I get bitcoind to advertise an onion address without setting a socks proxy?


You need a way for an onion service to be created, connected to and advertised. Usually, with Tor running on the same machine, just start bitcoind with the following option should do it depending if your installed versions of Tor and Bitcoin Core are new enough:

>bitcoind -listenonion

You may also need to override -bind=, -discover=, listen= and -externalip= after that to suit your exact configuration.

Of course, the setup in your question is a little different to standard. What you will need to do is:

  1. Bind your bitcoind to the network IP of the machine it is running on. It probably is already but, you can use -bind= if necessary.
  2. Ensure the firewall on your bitcoind machine will allow incoming connections to the bitcoind service from your Tor router. With firewall configuration, it is always best to be specific.
  3. Setup the onion service on your Tor router and point it to your bitcoind machine. Make a note of your onion service name.

    1. Ordinarily, you should be able to add the following lines to the /etc/tor/torrc file:

      HiddenServiceDir /var/lib/tor/bitcoin-service/
      HiddenServicePort 8333 {machine IP of bitcoind}:{mainnet port}
      HiddenServicePort 18333 {machine IP of bitcoind}:{testnet port}

      *Note that I have not tested this setup and presume Tor will allow you to specify the IP of your network machine running bitcoind

  4. You may consider adding 8333 to the LongLivedPorts parameter in your permanent Tor config and restart Tor unless you have a live configuration editor like nyx to also change it on the hop.
  5. Configure bitcoind to use and advertise the onion address for incoming connections. You can use -externalip={onion}. I am not sure if you can or if you need to specify this multiple times, for any standard IPv4/IPv6 external incoming addresses also.
  6. You may also consider using -discover=1 since you are not trying to hide your standard external IP addresses I presume.

In bitcoin-qt, you can see the command line options and their descriptions in the help menu.

  • tor is running on a separate machine. So I cannot do this. – jdejesus068 Feb 10 '18 at 8:27
  • @jdejesus068 I have extended my answer. Hope it helps. – Willtech Feb 10 '18 at 9:29

I've found a few options ya might want to play with from the bitcoin wiki and it looks like there's a command line option;

-onion=<ip:port>       Use separate SOCKS5 proxy to reach peers via Tor hidden services (default: -proxy)

Which should allow Tor and bitcoin to chat with one another and a related option;

-onlynet=<net>         Only connect to nodes in network <net> (ipv4, ipv6 or onion)

Which would allow you to lock it down to only select networking avenues. But that maybe counter to your desired use case. Because you've stated that your networked services are physically separate see the next few options ... {snip - removed security risk}

  • I don't think this lets you advertise the onion address, though. I think this just routes outbound connections via tor and rejects non-tor connections. – Nick ODell Nov 8 '16 at 22:42
  • Hmm, I'll keep looking round and edit if I find something. Might be worth it to try using iptables or proxy with nginx as a patch while I keep looking. – S0AndS0 Nov 9 '16 at 1:54
  • After further review I'm pretty sure of the previously posted answer. Just define the -rp~ options once to point at the box routing to Tor and again to your router or network switch to allow non-Tor traffic. – S0AndS0 Nov 9 '16 at 2:21
  • Oh wait, if you don't have two networking interfaces you may have to look into bridge networking to attach to more than one gateway at a time. – S0AndS0 Nov 9 '16 at 2:26
  • You do not want to bind your RPC to the onion service, it is a security risk. @jdejesus068 – Willtech Feb 10 '18 at 8:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.