On the usefulness and security of opening ports in context of clearnet and Tor[edit]

We have to clearly distinguish between opening when referring to clearnet versus referring to opening a port when using Tor.

Most times when talking generally about opening ports (clearnet, unrelated to Tor), technically one is referring to allow unsolicited incoming connections. Imagine a public web server. The websever is supposed to be able to reply to unsolicited incoming connections by clients. On the other hand however, clients usually (except when they are behind some corporate, national or similar firewall) can use any outgoing port. When a client is creating an outgoing connection, the operating system picks a random port where it expects the solicited incoming answer. Sometimes end users want to open a port such for example when they want to install a public webserver on their home connection. The end users have mostly unrestricted outgoing access, but unsolicited incoming connections are restricted by their home router's NAT firewall. Opening a port for them often means that they use their router's web interface, configure the port they want to open and forward it to a computer in their LAN network. Also when they are using a firewall that restricts unsolicited incoming connections, they need to open an incoming port in their firewall in order to make their server application reachable from the open internet. By doing so, the users real public IP address is exposed. You would not want to open a port using this method if you wish to stay anonymous.

When talking about Tor, the topic of opening ports often causes confusion. By default Tor works only as a client, which means it lets the user establish outgoing connections[1] and receives the solicited answers. The Tor software by default does not block any outgoing ports. However, some Tor exit relays restrict outgoing ports. In theory, if there was no Tor exit relay supporting outgoing port 22, then you could not exit the Tor network directly through that port. In these cases there would be no way to force open that port since that is a Tor relay, not Tor client setting.

Hosting Location Onion Services over Tor is possible. One way to accomplish this is using Onion Services. To oversimplify this, by configuration Tor it instructions the Tor network to open an incoming port at Tor relays for Tor onion hostname which gets forwarded to a port on the machine where Tor is running (called virtport). The users real public IP address remains hidden. That onion hostname is only reachable by other Tor clients.

As of Whonix 13, it makes limited sense to open a port. There are very few exceptions.

In Whonix 14 (in development), if you want to host a Tor onion service, you will need to open a port in Whonix-Workstation firewall so Whonix-Gateway can forward the incoming Tor onion service connection to Whonix-Workstation. This will be covered in Onion Services instructions.

When Tor users ask about how to open a port, they often do not need to and try to fix the wrong problem. Common issues are:

  • Services such as IRC servers ban connections from Tor users. This cannot be remedied by opening any ports.
  • Sometimes applications such as VPNs do not work. Either because one is trying to use UDP, while the Tor network does not support that [2] or because of VPN configuration issues, see Tunnels/Introduction.

If you really need an anonymous incoming port your primary option is Tor Onion Services and some methods listed on Hosting Location Hidden Services.


Undocumented. Pointers:

Forum Discussion[edit]

See Also[edit]


  1. TCP and some types of DNS
  2. Tor#UDP

Comments will be deleted after some time. Specifically after comments have been addressed in form of wiki enhancements. See Wiki Comments Policy.

Add your comment
Whonix welcomes all comments. If you do not want to be anonymous, register or log in. It is free.

Random News:

Want to get involved with Whonix? Check out our Contribute page.

https | (forcing) onion

Share: Twitter | Facebook

This is a wiki. Want to improve this page? Help is welcome and volunteer contributions are happily considered! See Conditions for Contributions to Whonix, then Edit! IP addresses are scrubbed, but editing over Tor is recommended. Edits are held for moderation.

Whonix is a licensee of the Open Invention Network. Unless otherwise noted, the content of this page is copyrighted and licensed under the same Libre Software license as Whonix itself. (Why?)

Whonix is provided by ENCRYPTED SUPPORT LP. See Imprint.