Tor as a VPN

Posted on Nov 13, 2023

Introduction

Rather than using traditional VPNs to access region-specific websites, one could use Tor as a VPN, most easily via the Tor Browser. However, it should be noted that you reduce your security benefits from using Tor, as traffic correlation attacks likely could be easier to make, simply because there is less entropy in your traffic behaviour.

Tor

Tor itself can refer to many things, the protocol, the piece of software or the Tor network (computers running Tor). The Tor protocol is an onion routing-based anonymous communication protocol. The current stable implementation is ctor or the WIP rust implementation, arti. The main special aspect of Tor connections is that they involve an additional three different hops using onion routing so that the:

  • Entry node (also known as a guard node, lists of guard relays change less frequently) - knowns the IP of the sender (you) but not the destination
  • Middle node - knows nothing about the sender’s original request
  • Exit node - does not know who you are but knows what website you are visiting, as this node would be the one sending the final requests to the server you wanted. This will be the most relevant node for this post

For more information please see the original paper of Tor or their support page which has some FAQ. This post can also be read from an onion service. If you simply put this article’s address into the Tor Browser you should be redirected to it via the onion location meta attribute.

Current Tor VPN efforts

The Tor project has a plan to create Tor VPN Client for Android. They want to add support UDP traffic over Tor, as currently Tor only works on TCP. UDP is usually used for VPN, given that higher throughput rather than more reliability is typically desired.

Approach

The approach to similarly using Tor as a traditional VPN to access region-specific websites is rather simple, all we have to do is specify the exit relay that we use to be in the desired country, as that is the only relay communicating with the server.

Tor exit node distributions

This information was obtained from Tor Project’s Onionoo. Below you can see the distribution of active Tor exit relays across the world. Note the gaps in certain regions.

World Map of the number of tor exit relays per country

For a table displaying the same information, please see the Appendix. Interestingly, the Netherlands has the highest number of exit relays, likely because of one of the largest relay families from https://nothingtohide.nl/, they have 287 exit relays.

Specifying exit relays

To use a specific subset of exit relays, one needs to edit their torrc file (the tor config file, typically located in ..TorBrowser/Data/Tor/torrc). For example, if I only want to use US exit relays I would add the following into my torrc file.

ExitNodes {us}
StrictNodes 1

The country codes are in the form of ISO 2.

If for some reason the region you want an exit node that is more specific than an entire country, for example, a specific state/ISP, then you could based on the IPs of the exit relays try to find one that meets your requirements. Thereafter, one can do the following in your torrc file.

ExitNodes NodeHash
StrictNodes 1

Appendix

For the methodology of how these numbers were obtained, please see https://gist.github.com/lucasalavapena/580a96c355d06f8e3ab773e08dcc96b2 . These hopefully are accurate for the state of the Tor network on :
Mon Nov 13 2023 13:12:48 GMT+0000

Table of Active Exit Relays per Country, listed in descending order

CountryActive Exit Relays
Netherlands493
Germany490
United States434
Poland255
Luxembourg113
Austria108
Romania88
France62
Norway59
Sweden54
Switzerland42
Russian Federation31
Iceland20
Canada19
Ukraine18
Moldova, Republic of17
Denmark16
United Kingdom15
Bulgaria15
Czechia13
Finland11
Croatia11
Singapore7
Italy5
Hungary5
South Africa4
Korea, Republic of3
Latvia3
Hong Kong3
Indonesia3
Costa Rica3
Estonia2
Viet Nam2
Belgium2
Kazakhstan2
Chile2
Brazil1
Taiwan, Province of China1
Peru1
Australia1
Japan1
Ethiopia1
Lithuania1
Mexico1
Israel1
Colombia1
Spain1