How to Set Up a Tor Exit Node on a VPS Hosted in Sweden from �4.99/mo

1. Order a VPS

Deploy a Sweden VPS with a dedicated IPv4 address and choose Ubuntu LTS (22.04 or 24.04) or a current Debian stable release as the operating system. Then log in over SSH.

2. Install Tor, DNS and the firewall

We use the Tor Project's own repository rather than the distribution's package, because it ships current, security-patched builds. Running an outdated relay hurts the network.

sudo apt update && sudo apt upgrade -y
sudo apt install -y apt-transport-https gpg wget lsb-release

wget -qO- https://deb.torproject.org/torproject.org/A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc | gpg --dearmor | sudo tee /usr/share/keyrings/tor-archive-keyring.gpg >/dev/null

echo "deb [signed-by=/usr/share/keyrings/tor-archive-keyring.gpg] https://deb.torproject.org/torproject.org $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/tor.list

sudo apt update
sudo apt install -y tor deb.torproject.org-keyring

sudo apt install -y unbound
sudo systemctl enable --now unbound

sudo sed -i 's/^#\?DNS=.*/DNS=127.0.0.1/' /etc/systemd/resolved.conf
sudo systemctl restart systemd-resolved
resolvectl query torproject.org

sudo ufw allow OpenSSH
sudo ufw allow 9001/tcp
sudo ufw enable

apt update && apt upgrade -y
apt install -y sudo apt-transport-https gpg wget lsb-release

wget -qO- https://deb.torproject.org/torproject.org/A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc | gpg --dearmor | sudo tee /usr/share/keyrings/tor-archive-keyring.gpg >/dev/null

echo "deb [signed-by=/usr/share/keyrings/tor-archive-keyring.gpg] https://deb.torproject.org/torproject.org $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/tor.list

sudo apt update
sudo apt install -y tor deb.torproject.org-keyring

sudo apt install -y unbound
sudo systemctl enable --now unbound

echo "nameserver 127.0.0.1" | sudo tee /etc/resolv.conf

sudo apt install -y ufw
sudo ufw allow 22/tcp
sudo ufw allow 9001/tcp
sudo ufw enable

3. Configure your exit relay

This step is identical on Ubuntu and Debian. Edit /etc/tor/torrc and replace its contents with the configuration below. It starts with a web-only exit policy, which attracts far fewer abuse reports than a wide-open exit.

Nickname SwedenExit01
ContactInfo you AT example DOT com
ORPort 9001
ExitRelay 1
SocksPort 0

# Keep bandwidth within your plan's fair usage
RelayBandwidthRate 8 MBytes
RelayBandwidthBurst 10 MBytes

# Web-only exit policy
ExitPolicy reject *:25
ExitPolicy accept *:80
ExitPolicy accept *:443
ExitPolicy reject *:*

• Nickname is the public name of your relay.
• ContactInfo lets the Tor Project and others reach you. Obfuscate the email to reduce spam.
• RelayBandwidthRate is in bytes, so 8 MBytes is about 64 Mbit/s. Adjust it to match your plan.
• Widen the exit policy later, once you are comfortable handling abuse reports.

4. Start Tor and check the logs

sudo systemctl enable tor@default
sudo systemctl restart tor@default
sudo journalctl -u tor@default -f

Look for a message saying your ORPort is reachable from the outside. Within a few hours your relay should appear on Tor Relay Search when you search for your nickname.

5. Set reverse DNS, automate updates and monitor

Set your IP's reverse DNS to something recognisable, such as tor-exit, so abuse desks can tell at a glance what it is. Then turn on automatic security updates, which work the same on Ubuntu and Debian:

sudo apt install -y unattended-upgrades apt-listchanges
sudo dpkg-reconfigure -plow unattended-upgrades

To include Tor itself, add "origin=TorProject"; to the Origins-Pattern list in /etc/apt/apt.conf.d/50unattended-upgrades. A monitor like Nyx is also handy for watching traffic and connections.