1

If I use Tor over VPN (User -> VPN -> Tor -> Destination), then VPN first encrypts my data and hides my original IP address, and then it goes to Tor's Entry Node. So that Tor's Entry Node can't read my data and doesn't know my original IP address. Now the data goes to Tor's Exit Node and it decrypts the data and sends it to the destination server. Now my question is that:

  1. after decrypting the data can Tor's exit node read my data (since the data is already encrypted by the VPN)?
  2. The Tor's exit node can know which site I am visiting. Hence is there any way to hide my destination server from Tor's exit node?
2

First: the Tor entry node cannot read your data. It's encrypted with your key before sent to you, and only you can decrypt the data. The only entity that knows your data is the exit node.

after decrypting the data can Tor's exit node read my data (since the data is already encrypted by the VPN)?

The exit node is the one that reads your data. It have to be this way, or it could not know which site you want to connect. So for practical effects, the exit node is the one making the connection, transmitting your data, receiving the response and sending it your way.

That data is not encrypted by the VPN because that connection ended a couple hops back: between the VPN server and the entry node. After reaching the entry node your data is encrypted again.

The VPN server have the same role as the Tor exit node: receive your encrypted request, decrypt it, sent it to the destination, read the response and send back.

If you chain Tor and VPN, your Tor client will encrypt all data expected to be sent to the entry node, your VPN client encapsulates it, the VPN server sends the data to the entry node, and now they are inside the Tor network.

The Tor's exit node can know which site I am visiting. Hence is there any way to hide my destination server from Tor's exit node?

No, there's no way.

How could the exit node know who you want to contact if it cannot know who you want to contact?

That's why you must only connect to sites over HTTPS when using Tor. Anything that is on clear (HTTP, SMTP, IRC, FTP) can be entirely read and even changed on-fly and you cannot detect. And if your browser complains about a certificate failure on any HTTPS site, don't proceed: the certificate was changed by the exit node.

Don't use Tor for anything that is not encrypted. You probably will use a trustful exit node, but you cannot guarantee, and you cannot know if the exit node is tainting your data or not.

1
  • Comments are not for extended discussion; this conversation has been moved to chat.
    – Rory Alsop
    Nov 10 '21 at 12:22
0

When you say "my destination server" I'm assuming you mean your server as opposed to "a or the" server on the internet.

Use .onion hidden services, that's what they are made for.

No exit node at all. No identifiable IP to server.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.