Tor IPv6 Dual-Stack: Configuration, Performance, and Relay Benefits

To advertise an IPv6 address in your relay descriptor, configure ORPort [IPv6_address]:9001 in torrc. If your server has a single IPv6 address, specify it directly. If it has multiple, choose the primary one. The OutboundBindAddressOR setting directs outbound relay connections to use a specific IP for IPv4 and IPv6. For a relay on a dual-stack VPS, typical configuration is: ORPort 0.0.0.0:9001, ORPort [::1]:9001 (replace ::1 with your actual IPv6 address). Verify IPv6 reachability using tor --verify-config and by checking your relay's descriptor on metrics.torproject.org/rs after the relay is running.

IPv6-reachable relays serve a growing segment of the Tor network as ISPs deploy IPv6. Some Tor users are on IPv6-only networks (particularly in Asia and mobile networks) and require IPv6-reachable relays for guard and middle positions. IPv6 relays may see higher bandwidth utilization as the Tor network routes more IPv6 clients through them. Additionally, running an IPv6 exit relay (with IPv6 exit policy allowing outbound connections) enables users to reach IPv6-only destinations. As IPv6 adoption grows, IPv6 relay support becomes increasingly important for network performance and coverage.

Hidden services themselves do not have IPv6 considerations from the client perspective - the .onion address and rendezvous circuit use the Tor network regardless of underlying IP versions. However, the hidden service server can reach introduction points and rendezvous points over either IPv4 or IPv6. Configuring the Tor client running the hidden service with IPv6 enabled (IPv6 traffic 1 in torrc, plus a usable IPv6 address) allows it to use IPv6 connections to relays, which may improve performance on networks where IPv6 routes are less congested than IPv4 routes. This is a marginal optimization compared to other tuning but can be relevant in specific network environments.

Exit relays must explicitly configure IPv6 exit policy. The default policy rejects all traffic. To allow IPv6 exit connections, add IPv6 exit policy lines in ExitPolicy: ExitPolicy accept6 *:80, ExitPolicy accept6 *:443, ExitPolicy reject6 *:*. A reduced exit policy for IPv6 (only allowing 80 and 443) provides IPv6 exit capability with reduced abuse surface area. IPv6 abuse complaints tend to be less common than IPv4, as IPv6 is less frequently scanned in automated abuse detection systems. IPv6-capable exit relays provide significant value to users needing to reach IPv6-only services.

Separate IPv4 and IPv6 traffic statistics in monitoring provides insight into IPv6 adoption impact on your relay. Prometheus with network interface metrics from node_exporter separates IPv4 and IPv6 bytes by interface. Alternatively, iptables/nftables rules for counting IPv4 and IPv6 bytes provide traffic breakdown. For exit relays, IPv6 exit traffic to specific destinations appears in netflow data if collected. Monitoring IPv6 connection count trends shows whether IPv6 relay connectivity is increasing as expected with network-wide IPv6 adoption. Alert on IPv6 ORPort becoming unreachable (firewall rule changes sometimes accidentally block IPv6 while leaving IPv4 intact).