1

BACKGROUND: My understanding is that at some point in the future i2p will be integrated into monero, so that it is trivial to launch the monerod daemon in such a way that it only communicates with other monero nodes exclusively over the i2p network (with the possible exception of the initial block download which would be done in the clear so as not to burden the anonymous network). There are several benefits to doing so, for example: 1) anonymous networks like Tor and i2p generally play nicely with home router firewalls, making it possible to receive traffic from other nodes without explicitly punching a hole in the firewall and 2) In countries where monero might be frowned upon, it will be harder to determine which citizens are actually running monero nodes and 3) Right now, when you connect to your node with your wallet and create a tx to broadcast it, the other nodes receiving the tx see the ip address of your node, and until Dandelion is added, there's a lot of info that can be gleaned from that. (I'm guessing this is even more of an issue if you're operating from behind a firewall and have no inbound connections, which I presume means that the only txs coming out of your node are your own.)

QUESTION: With all that in mind, the question is how much of this ideal (communicating with other monero nodes exclusively over an anonymity network) is achievable today, with the tech that has already been added to monero.

I am aware that you can connect your wallet via Tor or i2p to a remote node, but there are a lot of reasons with monero that it is better to run your own local node. So, let's say you have monerod running on your home computer (the same computer as your monero client), and it has its own copy of the full blockchain. How to get that node to interact with other nodes anonymously?

I have read the ANONYMITY_NETWORKS.md document multiple times. It says that the main mechanism for sending tx information anonymously between your node and other nodes is to use the --tx-proxy flag to direct the transactions through your i2p or Tor service running on your computer (in my case, I already have Tor running, so I've been using that). But then, it also says that if you do that, you need to manually --add-peer other onion nodes, presumably because your node has no way to discover an initial onion node to connect to. Once you connect to one, it sounds like you will be informed of others that exist and have specified that they permit anonymous inbound connections. The document provides no list of onion nodes to begin by connecting to.

So, I searched the web and only came up with a couple onion monero nodes: xmr.to and moneroworld, but adding them as peers did not actually work. I asked about this at Having trouble with tx-proxy and was told that they aren't full nodes communicating over Tor for the p2p traffic, they simply have a JSON RPC port that you can connect a wallet to remotely over Tor. Furthermore, I was told that at some point in the future, there will be some seed nodes that serve this purpose of being a reliable thing you connect to in order to discover the other peers that accept anonymous inbound connections, but that this does not currently exist.

So, is there a community of monero nodes out there running on an anonymity network, communicating with each other over Tor or i2p? If so, how do you connect into that network without a seed that tells you how to find the others?

1

How do you setup a node to communicate with other nodes only over an anonymous network?

Pretty much all of this is covered in ANONYMITY_NETWORKS.md.

Node to node communication, i.e. P2P traffic: for this you can use --tx-proxy ... and --add-peer ... / --add-exclusive-node ... with a node on an anonymity network to broadcast transactions only over the anonymity network.

That leaves you with block syncs over clearnet. If you used --add-exclusive-node ... with a node on an anonymous network instead of --add-peer ..., this would prevent any clearnet traffic at all, but with the drawback you would have no block syncing. hence why the relevant section of the document #p2p-commands recommends also adding clearnet peers.

With all that in mind, the question is how much of this ideal (communicating with other monero nodes exclusively over an anonymity network) is achievable today, with the tech that has already been added to monero.

Not "exclusively". Anonymity networks are a poor candidate for general block syncing due to their bandwidth limitations, which is why the work done so far has focused on tx broadcasting over anonymity networks, not block syncing. Also, hiding ones IP whilst block syncing is clearly less important than hiding ones IP when broadcasting a tx.

I have read the ANONYMITY_NETWORKS.md document multiple times... But then, it also says that if you do that, you need to manually --add-peer other onion nodes

It doesn't say that though. Quoting the document:

"It is therefore recommended that --add-exclusive-node be combined with additional exclusive IPv4 address(es)."

The point is this, if you try and restrict everything to anonymity networks, you won't be able to sync blocks, which is undesirable. Hence the recommendation is to integrate an anonymous network for tx broadcasting and everything else use clearnet. So use --tx-proxy ... with a tor/i2p node via --add-exclusive-node and add one or more --add-peer clearnet node(s).

Once you connect to one, it sounds like you will be informed of others that exist and have specified that they permit anonymous inbound connections.

If you add one or more nodes that are on anonymous networks, yes, they will share their peerlists of other anonymous nodes they have connected to.

Furthermore, I was told that at some point in the future, there will be some seed nodes that serve this purpose of being a reliable thing you connect to in order to discover the other peers that accept anonymous inbound connections, but that this does not currently exist.

This is incorrect. You were told: "The loose plan is for some trusted seed nodes first, to help the less technical users.". A "loose plan" is just that, a loose plan. This is all very much at an experimental stage and requires a certain level of technical expertise. Some known Monero nodes, on anonymous networks, serving as seed nodes for others, is one step that would make the experience easier.

So, is there a community of monero nodes out there running on an anonymity network, communicating with each other over Tor or i2p? If so, how do you connect into that network without a seed that tells you how to find the others?

Not really no. Those of us that have been developing this stuff of course have ran/run nodes over tor/i2p. The point is this: one can right now run a full node with both tor/i2p and clearnet. One can direct their local node to use their tor/i2p node for tx broadcasting. One can connect their wallet directly to their local node or their tor/i2p node.

| improve this answer | |
  • Does --tx-proxy do anything if you don't manually add a peer? Is it supopsed to be able to discover anonymous network peers through its clearnet connections? So far, my experience is that specifying --tx-proxy effectively shuts off tx broadcasting, because it can't find a tor/i2p node to broadcast to. And if one does need to manually add a peer, that gets back to the question: how do you discover the onion address of a peer to add? – puzzler Mar 9 at 6:45
  • No. It is not a switch to discover peers. It simply instructs your node where it can route Tor/i2p traffic, and that traffic is your tx broadcast. So if you provide a tx proxy but don't add any anonymous peers, you cannot broadcast your tx. Until there is something like seed nodes, you have to know someone running a peer on an anonymous network - or run your own. – jtgrassie Mar 9 at 15:11
  • Thanks, this confirms for me that I've understood correctly that there's not much you can do with tx-proxy unless you know other anonymous peers, which is difficult if there are no seed nodes and no public lists. The only point that confuses me still is your assertion that I can solve this by just "running my own" node on an anonymous network, when that's exactly what I'm trying to do, and the main mechanism for doing that is tx-proxy, which isn't useful if you don't know anyone else doing the same. – puzzler Mar 10 at 3:17
  • "running my own" < I quite happily run my own remote node which listens on i2p which I point my own local node at (over i2p). – jtgrassie Mar 10 at 16:58
  • I see, but if that remote node turns around and broadcasts the tx to its peers in the clear, has that really helped your anonymity? I assume the remote node is running a cloud service account associated with your identity. – puzzler Mar 10 at 18:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.