Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What is a Tor exit node; how does TR7 recognize Tor traffic?
Short answer
A Tor exit node is the last node in the Tor anonymity network, where the traffic exits to the internet (Tor Project · types of relays); the target system sees only the address of this node and cannot see the real client behind it. TR7 recognizes Tor traffic by looking not at the content but at the source address: in the network type classification, Tor Exit Node is a separate group and is bound to the Anonymizer (VPN / Proxy / Tor) category (Network Type Group); the Open Proxy category in the IP reputation database also covers Tor exit nodes alongside open proxy and open relay addresses. This information is used in the Network Type Group condition in the Load Balancer, in the Network Type Group Control block in L7 DDoS Protection, in the Tor Exit factor in Bot Protection and in the IP Reputation Protection rules.
Where It Is Used in TR7
| Where | Field / label | What for |
|---|---|---|
| Load Balancer → Conditions | Network Type Group = Tor Exit Node; Network Type Category = Anonymizer (VPN / Proxy / Tor) | An action specific to Tor traffic (blocking, redirecting to CAPTCHA…) |
| Bot/DDoS Management → L7 DDoS Protection | Network Type Group Control → Tor Exit Node | A limit or a direct action on the requests and connections coming from Tor exits |
| Bot/DDoS Management → Bot Protection → Factors | Tor Exit | The contribution of a Tor exit address to the bot score |
| Settings → General Settings → IP Intelligence & Reputation | IP Categories → Open Proxy | The addresses reported as open proxy, open relay and Tor exit node |
| Bot/DDoS Management → IP Reputation Protection | Default Rules | The Open Proxy category is put into quarantine in the default first rule |
Common Misconceptions
- "Tor traffic cannot be recognized because it is encrypted." Exit node addresses are known; TR7 recognizes the traffic not by its content but by its source address.
- "All Tor traffic is an attack." There are also legitimate users who use Tor for privacy; a choice is made among blocking, redirecting to CAPTCHA and restricting only on sensitive paths, according to the needs of the service.
- "The network type group and the Open Proxy category are the same list." The two are separate data sources: the Tor Exit Node group comes from the network type database, and the Open Proxy category from the IP reputation database; an address can be in both at once or in only one of them.
Handling Tor, VPN and data center addresses together: How do I recognize and handle Tor exit nodes, VPN/proxy addresses and data center (cloud/hosting) IPs separately?
How it is done in the documentation
