How do you setup a node to communicate with other nodes only over an anonymous network?

Question

BACKGROUND: My understanding is that at some point in the future i2p will be integrated into monero, so that it is trivial to launch the monerod daemon in such a way that it only communicates with other monero nodes exclusively over the i2p network (with the possible exception of the initial block download which would be done in the clear so as not to burden the anonymous network). There are several benefits to doing so, for example: 1) anonymous networks like Tor and i2p generally play nicely with home router firewalls, making it possible to receive traffic from other nodes without explicitly punching a hole in the firewall and 2) In countries where monero might be frowned upon, it will be harder to determine which citizens are actually running monero nodes and 3) Right now, when you connect to your node with your wallet and create a tx to broadcast it, the other nodes receiving the tx see the ip address of your node, and until Dandelion is added, there's a lot of info that can be gleaned from that. (I'm guessing this is even more of an issue if you're operating from behind a firewall and have no inbound connections, which I presume means that the only txs coming out of your node are your own.)

QUESTION: With all that in mind, the question is how much of this ideal (communicating with other monero nodes exclusively over an anonymity network) is achievable today, with the tech that has already been added to monero.

I am aware that you can connect your wallet via Tor or i2p to a remote node, but there are a lot of reasons with monero that it is better to run your own local node. So, let's say you have monerod running on your home computer (the same computer as your monero client), and it has its own copy of the full blockchain. How to get that node to interact with other nodes anonymously?

I have read the ANONYMITY_NETWORKS.md document multiple times. It says that the main mechanism for sending tx information anonymously between your node and other nodes is to use the --tx-proxy flag to direct the transactions through your i2p or Tor service running on your computer (in my case, I already have Tor running, so I've been using that). But then, it also says that if you do that, you need to manually --add-peer other onion nodes, presumably because your node has no way to discover an initial onion node to connect to. Once you connect to one, it sounds like you will be informed of others that exist and have specified that they permit anonymous inbound connections. The document provides no list of onion nodes to begin by connecting to.

So, I searched the web and only came up with a couple onion monero nodes: xmr.to and moneroworld, but adding them as peers did not actually work. I asked about this at Having trouble with tx-proxy and was told that they aren't full nodes communicating over Tor for the p2p traffic, they simply have a JSON RPC port that you can connect a wallet to remotely over Tor. Furthermore, I was told that at some point in the future, there will be some seed nodes that serve this purpose of being a reliable thing you connect to in order to discover the other peers that accept anonymous inbound connections, but that this does not currently exist.

So, is there a community of monero nodes out there running on an anonymity network, communicating with each other over Tor or i2p? If so, how do you connect into that network without a seed that tells you how to find the others?

Answer 1

How do you setup a node to communicate with other nodes only over an anonymous network?

Pretty much all of this is covered in ANONYMITY_NETWORKS.md.

Node to node communication, i.e. P2P traffic: for this you can use --tx-proxy ... and --add-peer ... / --add-exclusive-node ... with a node on an anonymity network to broadcast transactions only over the anonymity network.

That leaves you with block syncs over clearnet. If you used --add-exclusive-node ... with a node on an anonymous network instead of --add-peer ..., this would prevent any clearnet traffic at all, but with the drawback you would have no block syncing. hence why the relevant section of the document #p2p-commands recommends also adding clearnet peers.

With all that in mind, the question is how much of this ideal (communicating with other monero nodes exclusively over an anonymity network) is achievable today, with the tech that has already been added to monero.

Not "exclusively". Anonymity networks are a poor candidate for general block syncing due to their bandwidth limitations, which is why the work done so far has focused on tx broadcasting over anonymity networks, not block syncing. Also, hiding ones IP whilst block syncing is clearly less important than hiding ones IP when broadcasting a tx.

I have read the ANONYMITY_NETWORKS.md document multiple times... But then, it also says that if you do that, you need to manually --add-peer other onion nodes

It doesn't say that though. Quoting the document:

"It is therefore recommended that --add-exclusive-node be combined with additional exclusive IPv4 address(es)."

The point is this, if you try and restrict everything to anonymity networks, you won't be able to sync blocks, which is undesirable. Hence the recommendation is to integrate an anonymous network for tx broadcasting and everything else use clearnet. So use --tx-proxy ... with a tor/i2p node via --add-exclusive-node and add one or more --add-peer clearnet node(s).

Once you connect to one, it sounds like you will be informed of others that exist and have specified that they permit anonymous inbound connections.

If you add one or more nodes that are on anonymous networks, yes, they will share their peerlists of other anonymous nodes they have connected to.

Furthermore, I was told that at some point in the future, there will be some seed nodes that serve this purpose of being a reliable thing you connect to in order to discover the other peers that accept anonymous inbound connections, but that this does not currently exist.

This is incorrect. You were told: "The loose plan is for some trusted seed nodes first, to help the less technical users.". A "loose plan" is just that, a loose plan. This is all very much at an experimental stage and requires a certain level of technical expertise. Some known Monero nodes, on anonymous networks, serving as seed nodes for others, is one step that would make the experience easier.

So, is there a community of monero nodes out there running on an anonymity network, communicating with each other over Tor or i2p? If so, how do you connect into that network without a seed that tells you how to find the others?

Not really no. Those of us that have been developing this stuff of course have ran/run nodes over tor/i2p. The point is this: one can right now run a full node with both tor/i2p and clearnet. One can direct their local node to use their tor/i2p node for tx broadcasting. One can connect their wallet directly to their local node or their tor/i2p node.