Run a node over Tor | Divi Services

1Before you start

This page is for the original Divi node, divid 3.0.0. IronDivi 0.2.5 has no proxy setting, so it cannot be sent through Tor this way. If you have not installed the node yet, follow Install the Divi node first, and stop it before you change its settings.

What Tor does and does not do here:

It hides your IP address from peers. They see a Tor exit, or for onion connections nothing at all.
It does not hide that you use Tor. Your internet provider can see Tor traffic, just not what is inside it.
It is slower. Our testnet node took 51 minutes to download the whole chain over Tor.

The commands are for Linux. The settings themselves are the same on any computer.

2Get Tor running

On Debian or Ubuntu, install Tor from the package manager. It starts by itself and listens on port 9050 on your own computer:

sudo apt install tor
ss -ltn | grep 9050
LISTEN 0  4096  127.0.0.1:9050  0.0.0.0:*

That line means Tor is ready. We tested with Tor 0.4.9.11, run as a separate copy on its own port, 53661, so it would not disturb the Tor already on our test machine. If you do the same, put your own port wherever this page says 9050.

3Send the node through Tor

Add these lines to divi.conf in the node's data folder, next to what is already there:

proxy=127.0.0.1:9050
listen=0
listenonion=0

proxy sends every connection through Tor, including the look-up of names such as services.divi.domains. The node then also stops trying to find out its own public address.
listen=0 stops the node from accepting connections from outside. Incoming connections would not go through Tor, so they would show your address.
listenonion=0 switches off the node's own attempt to make an onion address. It does not work with today's Tor; step 4 explains.

Start the node as usual. To see it working, add debug=net to the file for a while and look in debug.log:

SOCKS5 connecting services.divi.domains
SOCKS5 connected services.divi.domains
SOCKS5 connecting 15.204.243.46
SOCKS5 connected 15.204.243.46

Some peers close the connection straight after Tor connects. The node moves on and tries others, so give it time. Ours spent its first half hour on the first 100,000 blocks, then sped up.

4Give the node an onion address

An onion address lets other nodes connect to yours through Tor, without your IP address appearing anywhere. Tor makes the address for you. Add two lines to Tor's settings file, /etc/tor/torrc:

HiddenServiceDir /var/lib/tor/divi/
HiddenServicePort 51474 127.0.0.1:51474

The first number is the port other nodes will use, the second where your node listens. 51474 is testnet. On the real network use 51472 for both. Restart Tor and read the new address:

sudo systemctl restart tor
sudo cat /var/lib/tor/divi/hostname
u7xzvhw7alruj6q5mwtbwuwxw73qx57cblrkdc2f57nskttortatnyid.onion

Yours will be different: 56 letters and digits, then .onion. Now let the node listen, but only on your own computer, so the one way in is through Tor. In divi.conf, change listen=0 to:

listen=1
bind=127.0.0.1

Restart the node. It does not announce the onion address to the network, so tell the people you want to connect to it.

The node's own onion settings do not workThe node has a built-in way to make an onion address, listenonion=1. It asks Tor for the old, short kind of onion address, which Tor no longer makes, and the log says tor: Add onion failed; error code 513. Setting externalip= to your onion address does not help either: the node stops with Error: Cannot resolve -externalip address. Use the two lines in torrc above instead.

5Connect a second node to the onion

This is how a friend's node, or your own second node, reaches the first one. Its divi.conf needs the proxy too, and a connect line with the onion address and port:

proxy=127.0.0.1:9050
listen=0
listenonion=0
connect=u7xzvhw7alruj6q5mwtbwuwxw73qx57cblrkdc2f57nskttortatnyid.onion:51474

connect means this node talks to no one else. Use addnode instead if it may also find other peers. Our second node started with no chain at all and downloaded it through the onion address alone, from our first node, about 245,000 blocks in its first 50 minutes.

In getpeerinfo the second node shows the onion address as its peer, and the first node shows the second as an incoming connection from 127.0.0.1, because Tor hands the connection over on the same computer.

6Check what the node is doing

divi-cli getnetworkinfo

Look at the networks part. Each network, ipv4, ipv6 and onion, should show your Tor port as its proxy. Ours showed its own port, 53661:

"networks" : [
    {
        "name" : "ipv4",
        "limited" : false,
        "reachable" : false,
        "proxy" : "127.0.0.1:53661",
        "proxy_randomize_credentials" : true
    },
    … the same for ipv6, and for onion with "reachable" : true
]

A node that does not use Tor shows "proxy" : "" there instead.

Then check that the node keeps up with the chain, as with any node:

divi-cli getconnectioncount
divi-cli getblockcount

If something goes wrong

What you see	What to do
No connections at all	Check that Tor runs (`ss -ltn \| grep 9050`) and that the port in `proxy=` matches. Wait a few minutes: many peers close Tor connections, and the node has to find ones that do not.
`tor: Add onion failed; error code 513` in `debug.log`	The node's built-in onion address does not work with today's Tor. Set `listenonion=0` and use `HiddenServiceDir` in `torrc` (step 4).
`Error: Cannot resolve -externalip address` and the node stops	Remove the `externalip=` line with the onion address.
The second node never connects to the onion	Check the address letter by letter and the port after it. On the first node, check that `listen=1` and `bind=127.0.0.1` are set and that the second number in `HiddenServicePort` is the port the node listens on.
`getnetworkinfo` shows `"proxy" : ""`	The node did not read the `proxy=` line. Check that it is in the `divi.conf` of the data folder the node uses, and restart it.

Next: run your node as a service, or browse the chain privately with the explorer over Tor.