Exploring the roots and future of Internet Relay Chat

Running an IRC Server Over Tor: Privacy at the Protocol Level

May 28, 2024 — by Marco Pellegrini

There are legitimate reasons to want a private, anonymous IRC server. Journalists communicating with sources. Activists organizing in hostile environments. Researchers discussing sensitive security topics. Or simply people who believe that private communication is a right, not a privilege.

Tor hidden services (now officially called "onion services") provide a way to run an IRC server that is accessible only through the Tor network, hiding both the server's physical location and the users' identities. I'm not going to debate the politics of anonymity here — I'll just show you how to set it up technically and what the trade-offs are.

Why Run IRC Over Tor?

A regular IRC server, even with TLS, reveals several things:

  • The server's IP address is visible to anyone who connects
  • Your ISP can see that you're connecting to that specific IP
  • The server operator can see your real IP address
  • Network observers can perform traffic analysis to correlate users

A Tor onion service addresses all of these:

  • The server's physical location and IP are hidden behind a .onion address
  • Users connect through Tor, hiding their real IP from the server
  • ISPs see only Tor traffic, not the specific destination
  • End-to-end encryption within the Tor network (no exit node involved)

That last point is important. When you access a .onion address, your traffic never leaves the Tor network — there's no exit node. This means the connection is encrypted end-to-end by Tor itself, in addition to any TLS encryption on the IRC connection.

Architecture: How It Works

[User's IRC Client]
    ↓ (connects to localhost SOCKS proxy)
[Tor Client (on user's machine)]
    ↓ (Tor circuit through 3 relays)
[Tor Network]
    ↓ (rendezvous point)
[Tor Daemon (on server)]
    ↓ (forwards to localhost)
[IRC Server (listening on localhost only)]

The IRC server listens only on localhost (127.0.0.1). The Tor daemon on the same machine creates an onion service that forwards incoming connections to the local IRC port. Users connect through the Tor network using the .onion address. At no point does the IRC server touch the public internet directly.

Setting Up the Tor Hidden Service

Install Tor:

# Debian/Ubuntu:
sudo apt install tor

# CentOS/RHEL:
sudo dnf install tor

Configure the onion service in /etc/tor/torrc:

HiddenServiceDir /var/lib/tor/irc_hidden_service/
HiddenServicePort 6697 127.0.0.1:6697
HiddenServiceVersion 3

Restart Tor:

sudo systemctl restart tor

Your .onion address will be generated automatically:

sudo cat /var/lib/tor/irc_hidden_service/hostname
# Output: something like abc123def456ghi789jkl012mno345pqr678stu901vwx234yz.onion

That's your IRC server's Tor address. It's a v3 onion address (56 characters), which provides stronger security than the old 16-character v2 addresses (deprecated since Tor 0.4.6).

IRCd Configuration for Tor

The key principle: the IRC server should only listen on localhost. No public-facing ports.

UnrealIRCd:

listen {
    ip 127.0.0.1;
    port 6697;
    options { tls; };
};

# Don't listen on public interfaces:
# listen { ip *; ... };  ← REMOVE THIS

# Set for Tor users (they all appear from 127.0.0.1):
allow {
    mask 127.0.0.0/8;
    class clients;
    maxperip 50;  # Higher limit since all Tor users share the IP
};

# Enable cloaking so users don't all show as localhost:
set {
    cloak-keys { ... };
};

InspIRCd:

<bind address="127.0.0.1" port="6697" type="clients" ssl="gnutls">

<connect name="tor"
         allow="127.0.0.0/8"
         maxlocal="50"
         maxglobal="50"
         localmax="50"
         globalmax="50">

The maxperip / maxlocal setting is crucial. All Tor users appear to come from 127.0.0.1, so the normal per-IP connection limit would restrict your entire user base to a handful of connections. Set it high enough for your expected user count.

Connecting Clients Through Tor

Users need Tor running on their machine and an IRC client configured to use the Tor SOCKS proxy (usually on localhost:9050).

WeeChat:

/proxy add tor socks5 127.0.0.1 9050
/server add mytor abc123...onion/6697 -tls -proxy=tor
/connect mytor

irssi:

# Install torsocks, then:
torsocks irssi -c abc123...onion -p 6697 --ssl

HexChat: Set the SOCKS5 proxy to 127.0.0.1:9050 in Settings → Preferences → Network Setup → Proxy Server. Then add the .onion address as a server.

Operational Security Considerations

Running a Tor IRC server requires thinking about operational security at every level:

  • Server identity: Don't run other identifiable services on the same machine. A web server with your real identity on the same IP defeats the purpose of the hidden service.
  • Time correlation: If the server goes down every night at the same time (because you turn off your home computer), an observer can narrow down your timezone. Run it on a VPS or a machine that stays on 24/7.
  • Traffic analysis: While Tor hides the content and endpoints of connections, traffic volume patterns can potentially be correlated. This is a theoretical concern for most operators but worth being aware of.
  • Server software identification: IRCd version strings and MOTD content can identify your server. Customize or remove identifying information.
  • Logging: Decide upfront whether you'll log connections and messages. If the server is seized, logs become evidence. If you don't log, you can't investigate abuse. There's no right answer — it depends on your threat model.

Limitations and Trade-offs

Latency: Tor adds significant latency — typically 200-500ms per hop, with three hops minimum. IRC is a real-time protocol, and the added latency is noticeable. Messages take a second or two longer to appear. It's usable but not snappy.

Reliability: Tor circuits can be unstable. Users may experience more frequent disconnections than on a direct connection. A bouncer running on the same server as the IRC daemon can mitigate this — the bouncer-to-server connection is local, so only the user-to-bouncer connection goes through Tor.

DDoS vulnerability: Onion services have historically been targets for DDoS attacks. Tor's introduction of proof-of-work challenges for onion services (in Tor 0.4.8+) helps, but it's still a concern.

No DCC: DCC (Direct Client-to-Client) connections don't work through Tor, since they require direct IP-to-IP connectivity. File transfers and DCC chat are not available.

Trust model: You're trusting the Tor network for anonymity. If Tor itself is compromised (through traffic analysis, relay compromise, or protocol vulnerability), the anonymity guarantees break down. For most threat models, Tor is sufficient. For nation-state adversaries, the picture is more complex.

Running an IRC server over Tor isn't for everyone. The added complexity, latency, and operational security requirements make it overkill for casual use. But for communities that genuinely need anonymous communication — and there are many — it's one of the most practical solutions available.

Frequently Asked Questions

Can regular (non-Tor) users connect to a Tor IRC server?

Only if you also expose the server on a public IP or domain. A pure onion service is accessible only through Tor. Some operators run "dual-stack" setups — accessible both via Tor and via a regular hostname — but this increases complexity and partially defeats the anonymity benefits.

Is running a Tor IRC server legal?

In most jurisdictions, running a Tor service is legal. However, the content on the server is your responsibility as operator. The same laws that apply to regular IRC servers apply to Tor-accessible ones. Consult legal advice for your specific jurisdiction if you're concerned.

How do I handle abuse on a Tor IRC server?

Traditional abuse mitigation (IP bans) doesn't work since all users appear from localhost. Instead, use account-based controls: require registration, implement channel permissions, and use services-level bans (NickServ/ChanServ account bans). Some operators also use invite-only channels or require vouching from existing members.

Can I link Tor IRC servers together?

Yes. Server-to-server links can also go through Tor onion services. Configure each server's link block to use the other server's .onion address through the Tor SOCKS proxy. Latency will be higher than direct links, but the linking itself works normally.

FAQ

Can you run IRC over Tor?

Yes. Many IRC networks accept connections through Tor hidden services. The server runs a Tor hidden service endpoint, and clients connect using a SOCKS5 proxy through the Tor network.

Is IRC over Tor slow?

Latency increases significantly (often 1-5 seconds per message round trip). It's usable for text chat but DCC transfers are generally impractical over Tor.

Which IRC networks allow Tor?

OFTC, Libera.Chat, and several others provide official Tor hidden service endpoints. Some networks block Tor entirely due to abuse concerns. Check the network's documentation for current policy.