Nultow
Tor

Onion access

Nultow runs a v3 onion service on the Helsinki node for the web, panel and API. It is never an exit relay, and hidden-service traffic never touches the public internet.

The onion address is published to guests once the Tor phase (F6) is deployed.

How to connect

  1. 1

    Get the onion address

    The address is available in the panel footer and in the Docs. It looks like a 56-character base32 label ending in .onion.

  2. 2

    Get your client key (optional)

    The panel and API onion services can require x25519 client authorization. Your administrator provides a .auth_private file or secret for your account.

  3. 3

    Open it in Tor Browser

    Paste the address into Tor Browser. If client auth is enabled, add the key under Settings → Privacy & Security → Onion Services Authentication.

  4. 4

    Bookmark and use

    Once loaded you get the same panel as clearnet, without exposing your IP to the front-end nodes.

Security properties

  • v3 onion service with an ed25519 service key held on the node only.
  • Optional x25519 client authorization per guest for panel and API.
  • Proof-of-work and rate limiting enabled against DoS.
  • No exit traffic: the relay cannot be used to reach third-party services.
  • OVH (Montreal) does not host Tor; the service runs on Helsinki only.

Good to know

  • Tor is slower than the direct VPN; use it for panel administration, not bulk traffic.
  • Clearnet pages advertise the onion mirror through the Onion-Location header.
  • Client keys rotate; ask your administrator if the key stops working.

Frequently asked

Do I need the VPN to use the onion service?

No. Tor reaches the onion service directly. You still need a valid Nultow account for the panel and API.

Is the onion service a different account?

No. It is the same control plane and the same sessions, reached over a different transport.

Can I use the onion with the Android app?

The F8 app targets the clearnet API. Onion access is browser-first, with client-auth key import planned.

What if I lose my client key?

Ask an administrator to issue a new .auth_private file. Losing the key does not affect VPN configurations.

Onion access · Nultow