VPS for Tor relays and exit nodes

Running a relay from your home connection works for a small bridge, but it has hard limits. Residential bandwidth is asymmetric and capped, your ISP may throttle or flag sustained outbound connections, and an exit node tied to your home IP points abuse complaints — and worse — directly at your front door. A VPS solves all three: symmetric bandwidth, an IP with no connection to your identity, and legal/network separation between you and the traffic your node carries.

The other reason is uptime and reputation. Tor's bandwidth authorities measure your node over days and weeks before granting the Guard or Exit flags that make it useful. A box that reboots when your laptop sleeps never earns them. A VPS with a 99.97% uptime SLA stays in the consensus continuously, climbs the weighting, and actually carries traffic. Deploy is fast — about a 47-second median — so you can have a relay in the consensus the same hour you decide to run one.

Pay in Monero (XMR) and the chain from payment to running node carries no identity at any step. XMR credits your balance in roughly 30 seconds; you top up, then deploys debit the balance, so there is no card, no invoice trail, and no recurring authorization tied to a name.

Tor nodes come in three flavours, and the operational risk profile differs sharply:

• Middle (non-exit) relay — forwards encrypted traffic between other Tor nodes. It never connects to the open internet on a user's behalf, so it generates essentially zero abuse complaints. Safest to run anywhere.
• Bridge — an unlisted relay that helps users in censored networks reach Tor. Low-profile, low-complaint, low-bandwidth.
• Exit relay — the node that makes the final connection to the destination site. To the outside world, the traffic appears to originate from your VPS IP, which means abuse complaints, scan reports, and DMCA notices land on the hosting account.

All three are explicitly permitted at NoKycVPS. Tor relays and exits sit alongside I2P, mixnets, VPN exits, and crypto nodes on our allowed-use list. We run no proactive content monitoring. The single zero-tolerance exception is CSAM. The network-abuse rules (no outbound spam, no mass scanning of third parties, no amplification attacks) are about your server originating attacks — they do not restrict relaying other people's Tor traffic.

What this means in practice: when an abuse complaint arrives for exit traffic, we do not suspend your box or demand you justify yourself. Action against an account requires a binding judicial order from a court with jurisdiction over our operating entity in Saint Kitts and Nevis, served properly — and we notify you before we act. Our monthly warrant canary documents that posture. Compare that with mainstream hosts on our best-of roundups, where a single complaint often ends the account.

Tor is more bandwidth- and CPU-bound than memory-bound. The relevant CPU cost is the TLS and circuit crypto, which scales with how much traffic you carry. Match the tier to your ambition:

• Middle relay or bridge → S1. 2 vCPU / 4 GB DDR5 / 80 GB NVMe Gen5, from $5/mo. Comfortably saturates a few hundred Mbps of relayed traffic. The default tor process is single-process; this tier is plenty for one busy middle relay.
• Exit node → S2 (Pro, recommended). 4 vCPU / 16 GB / 320 GB, from $15/mo. The extra cores let you run multiple tor instances on one box (each pins a core for crypto) and push real exit bandwidth. This is the sweet spot for a contributing exit.
• High-bandwidth or multi-instance exit → S3 (Power). 8 vCPU / 32 GB / 640 GB, from $30/mo. Run several tor instances behind a MyFamily declaration and push multi-gigabit exit traffic on the 10 Gbps unmetered link.

All tiers are AMD EPYC with a /64 IPv6 block included, so you can run IPv6-reachable relays without extra cost. A single tor process is effectively single-threaded for its crypto, so to use 8 cores you run one instance per core and bind each to its own ORPort. Pick your tier on the VPS plans page or jump straight to ordering an S2.

Exit nodes attract attention; middle relays and bridges do not, so jurisdiction matters most for exits. We offer identical hardware in four regions, so you choose purely on legal posture and latency to your target traffic:

• Reykjavik, Iceland (REK) — strong fit for exits. Iceland's IMMI press-freedom initiative, no mandatory data retention, and renewable geothermal power make it a long-standing home for free-expression infrastructure.
• Zurich, Switzerland (ZRH) — strong constitutional privacy under the FADP, outside the 14-Eyes arrangement, and Article 271 of the penal code restricts assisting foreign authorities. Excellent for an exit you want insulated from foreign pressure.
• Bucharest, Romania (OTP) — EU connectivity, historically resistant to overbroad takedown pressure, and the lowest-cost region. A practical choice for a high-bandwidth EU exit.
• Paris, France (PAR) — robust peering and the cheapest pricing, but EU/GDPR with more routine takedown traffic. Best suited to middle relays rather than headline exits.

For exits, Iceland and Switzerland are the conservative picks; for middle relays the choice is just latency and price. Full legal detail on each is on the offshore hosting pages.

A relay only earns weight from the bandwidth authorities if its IP is reachable and not already blocklisted. We assign IPv4 addresses from ranges that are not pre-flagged as proxy/VPN space, and the /64 IPv6 block is fresh allocation — so a new relay is reachable from the start rather than fighting a reputation it inherited.

Once your exit is live, plan for these realities:

• Abuse complaints. Exit traffic generates DMCA notices, scan reports, and the occasional law-enforcement inquiry, all pointing at your VPS IP. We forward what we receive and take no unilateral action; you handle them. Publishing a clear exit notice and reduced-exit-policy on common ports cuts the volume dramatically.
• MyFamily. If you run more than one relay — on this box or any other — set the MyFamily directive listing every relay's fingerprint so Tor never builds a circuit using two of yours. This is required etiquette and the bandwidth authorities expect it.
• Ramp-up. New relays are rate-limited by the network for the first few days while reputation builds. Do not panic at low traffic in week one; it climbs as you accrue the Guard/Exit flags.
• Reverse DNS and exit notice. Set a PTR like tor-exit.yourdomain and host a short HTML notice; abuse desks that see it route complaints correctly instead of escalating.

The end-to-end build — installing tor, writing torrc, declaring MyFamily, setting the exit policy, and registering contact info — is in the run-a-Tor-relay guide. For a hardened single-purpose exit, see also the anonymous server use case.