Which VPS allows a Tor exit node?

What is a Tor exit node, and how is it different from a relay or a bridge?

A Tor exit node is the last relay of a Tor circuit: it sends traffic to the destination, which sees the exit's IP address instead of the user's. That is why abuse complaints about Tor traffic reach the exit operator, and why some hosts refuse exits.

• Guard and middle relays carry encrypted traffic between relays. They never connect to websites.
• Bridges are relays left out of the public Tor directory, so censors find them harder to block. They draw few complaints.
• Exit relays connect to the open internet for Tor users. The Tor Project advises against running one from home.

Which VPS hosts allow Tor exit nodes?

OffshoreKVM allows exits on every plan and in every location, with no ticket or approval. In OffshoreKVM's check of 29 October 2026, 11 of 36 active offshore VPS hosts published a rule allowing Tor exits. Several set conditions, and 3 hosts forbade exits. Two of the 11, MyNymBox and IncogNET, had no plan in stock that day; BuyVM had only its 32 GB plan.

Which OffshoreKVM plan should I pick for a Tor relay?

Pick KVM 1 for a bridge, KVM 2 for a middle relay or a small exit, and KVM 4 or more for a busy exit. The Tor Project recommends 1.5 GB of RAM per Tor instance for an exit, and 512 MB for a non-exit relay under 40 Mbit/s.

For a Tor relay, the traffic quota sets the speed you can sustain: a relay that sends a steady 10 Mbit/s uses about 3.2 TB in 30 days. The Tor Project's minimum for a relay is 10 Mbit/s, and it recommends more than 2 TB of traffic a month.

What does the Tor Project recommend for exit operators?

The Tor Project asks exit operators to limit ports, label the IP address, publish a notice and answer complaints calmly. Its exit guidelines and setup page list these points:

• Use the reduced exit policy. ReducedExitPolicy 1 allows about 65 ports, including 80 and 443, and blocks most TCP ports. Fewer ports mean fewer complaints.
• Set reverse DNS that says what the IP does. Use a name with "tor-exit" in it, on a domain you own. Reverse DNS is set on the IP owner's side, so request it from support.
• Publish an exit notice on port 80. The Tor Project offers a template, tor-exit-notice.html, served with DirPortFrontPage.
• Run your own DNS resolver. A local caching, DNSSEC-validating resolver such as Unbound, with no forwarders. Do not use Google, Cloudflare, Quad9 or OpenDNS.
• Prefer a dedicated IP and a network with few exits. Concentrating exits at one provider does not help the network.
• Answer abuse reports professionally. Point to ExoneraTor, which shows that an IP ran a Tor relay at a given time.
• Set ContactInfo. It must be a working address if you run more than one relay.

# Install: apt update && apt install tor
# (the Tor Project recommends its own Debian/Ubuntu package repository)
Nickname    myOffshoreExit
ContactInfo [email protected]      # published with the relay
ORPort      443
SocksPort   0
ExitRelay   1
ReducedExitPolicy 1                # about 65 ports; 25 is not among them
IPv6Exit    1
# Exit notice on port 80 (template: contrib/operator-tools/tor-exit-notice.html)
DirPort     80
DirPortFrontPage /etc/tor/tor-exit-notice.html

# Apply: systemctl restart tor@default

Why should my exit policy reject port 25?

Your exit policy should reject port 25 because outgoing port 25 is closed on every OffshoreKVM VPS. An exit that offered it would fail every client that tried. Tor's default exit policy already starts with reject *:25, and the reduced exit policy does not list port 25. Leave it that way.

Ports 465 and 587 are in the reduced policy, and they stay open on OffshoreKVM towards mail providers. Other hosts set the same rule for exits: BuyVM requires its exits to block ports 25, 465 and 587, and VPSDEN asks exits to block SMTP. The page on whether you can host an email server on an offshore VPS explains the port 25 rule.

What happens when my exit gets a complaint?

DMCA notices about your exit's traffic change nothing at OffshoreKVM. DMCA ignored: we do not act on DMCA notices or other foreign copyright notices. We answer only to Panamanian law and to orders of Panamanian courts. The meaning of DMCA ignored for an offshore VPS explains the policy in full.

The datacenter still follows its own country's law. The reduced exit policy, a clear reverse DNS name and an exit notice cut the reports an exit receives. That is why the Tor Project asks for them. The rules of use also apply to the server itself: read what is not allowed on OffshoreKVM before you start.

Which location is best for a Tor exit?

The best location is a network that few exits already use, in a country whose law you have checked. The Tor Project suggests asking on the tor-relays mailing list and checking its GoodBadISPs page before you choose.

OffshoreKVM runs in Amsterdam (EU), Reykjavik (EEA, outside the EU), Zurich (outside the EU and the EEA) and Bucharest (EU), at the same price. Compare which country is best for offshore hosting for the legal side, and see the best offshore VPS in 2026 for other hosts.