⛏️ Run Your Own Monero Node

Download the Official Binary

The /cli/linux64 URL is a redirect to the current release archive. Name the output file to match the entry in the signed hash list, otherwise the later comparison silently has nothing to match.

# Redirects to monero-linux-x64-v0.18.5.1.tar.bz2 as of 2026-08-05
wget https://downloads.getmonero.org/cli/linux64 -O monero-linux-x64-v0.18.5.1.tar.bz2

Verify the Signature (CRITICAL)

Monero core developers sign a list of release hashes. binaryFate signs it, and the file is clearsigned, so the signature travels inside hashes.txt itself. ^[5]

# One time: import binaryFate's public key from the source repository
curl https://raw.githubusercontent.com/monero-project/monero/master/utils/gpg_keys/binaryfate.asc | gpg --import

# The fingerprint must be exactly this. If it is not, delete the key immediately.
gpg --fingerprint 81AC591FE9C4B65C5806AFC3F0AF4D462A0BDF92

# Verify the signature on the hash list
curl https://www.getmonero.org/downloads/hashes.txt > /tmp/reference-hashes.txt
gpg --verify /tmp/reference-hashes.txt

# Expected line in the output:
# gpg: Good signature from "binaryFate <binaryfate@getmonero.org>"

# Compare the archive against the signed list. This output must NOT be empty.
file_hash=`sha256sum monero-linux-x64-v0.18.5.1.tar.bz2 | cut -c 1-64`
grep $file_hash /tmp/reference-hashes.txt

If the signature check fails, or if grep prints nothing, stop. Do not extract the archive.

Extract and Configure

# Extract (the directory name carries the version)
tar -xvf monero-linux-x64-v0.18.5.1.tar.bz2
cd monero-x86_64-linux-gnu-v0.18.5.1/

# Data directory. monerod uses ~/.bitmonero by default.
mkdir -p ~/.bitmonero

# Config file. monerod looks for bitmonero.conf in the data directory.
nano ~/.bitmonero/bitmonero.conf

Essential Configuration

Config keys are command-line option names with the leading dashes removed, and value-less options take =1. The block below follows the official desktop template. ^[6]

# ~/.bitmonero/bitmonero.conf
# Full option list: https://docs.getmonero.org/interacting/monerod-reference/

# Centralized services
check-updates=disabled     # do not query DNS TXT records for new versions
enable-dns-blocklist=1     # block known malicious nodes via the DNS blocklist

# Banlist (optional, static)
#ban-list=/path/to/ban.txt

# Logging
log-level=0                # minimal logs, does not log peers or wallets connecting
max-log-file-size=2147483648

# Network limits
out-peers=12               # default 12
in-peers=48                # default is unlimited
limit-rate-up=1048576
limit-rate-down=1048576

# Optional pruning
#prune-blockchain=1
#sync-pruned-blocks=1

# Database sync mode: slower writes, more crash-resistant
#db-sync-mode=safe:sync

Start the Daemon

# Foreground
./monerod

# Background, then watch the log
./monerod --detach
tail -f ~/.bitmonero/bitmonero.log

# Custom data directory
./monerod --data-dir /path/to/blockchain

# Pruned from the first sync (frees two thirds of the disk space)
./monerod --prune-blockchain

# Accept pruned blocks instead of pruning them yourself (saves network transfer)
./monerod --prune-blockchain --sync-pruned-blocks

# Ask the running daemon to shut down cleanly
./monerod exit

Install Tor

sudo apt install tor
sudo systemctl enable tor
sudo systemctl restart tor

Two Hidden Services, Two Ports

One onion address can offer several services on different virtual ports. The official setup publishes 18084 for the P2P interface and 18089 for the restricted RPC interface that wallets connect to. Port 18081 is the unrestricted API and belongs on localhost only. ^[9]

# /etc/tor/torrc
HiddenServiceDir /var/lib/tor/monerod
HiddenServicePort 18089 127.0.0.1:18089   # wallet interface (restricted RPC)
HiddenServicePort 18084 127.0.0.1:18084   # P2P interface (anonymous-inbound)

sudo systemctl restart tor

# Your onion address
sudo cat /var/lib/tor/monerod/hostname

# Back up /var/lib/tor/monerod to keep control of that address

# ~/.bitmonero/bitmonero.conf

# Broadcast transactions originating from connected wallets over Tor.
# Forwarded transactions from other peers still travel over clearnet.
tx-proxy=tor,127.0.0.1:9050,12,disable_noise

# Advertise your onion P2P address so peers can relay their transactions to you.
# Replace with the hostname from the step above. The port is NOT 18080.
anonymous-inbound=yourlongv3onionaddress.onion:18084,127.0.0.1:18084,24

# Restricted RPC on localhost, published to Tor by the hidden service
rpc-restricted-bind-ip=127.0.0.1
rpc-restricted-bind-port=18089
rpc-ssl=autodetect

# Be forgiving to wallets arriving through the Tor daemon
disable-rpc-ban=1

Command-Line Variants

These are the documented configurations, in increasing order of exposure to Tor. ^[8]

# Sync over clearnet, relay your own transactions over Tor
./monerod --tx-proxy tor,127.0.0.1:9050,10

# Sync to IPv4 peers through the SOCKS proxy. Your ISP sees Tor, not monerod.
./monerod --proxy 127.0.0.1:9050 --p2p-bind-ip 127.0.0.1

# Same, plus outbound connections to onion peers for transaction relay
./monerod --proxy 127.0.0.1:9050 \
  --p2p-bind-ip 127.0.0.1 \
  --tx-proxy tor,127.0.0.1:9050,10

# Pad relayed transactions to the next 1024 bytes against traffic volume
# analysis. Only meaningful behind Tor or I2P.
./monerod --tx-proxy tor,127.0.0.1:9050,10 --pad-transactions

--proxy routes everything, including blockchain sync and update checks, and treats the proxy as the clearnet zone. --tx-proxy is the flag that turns on anonymity-network mode. Connecting exclusively to hidden services is not supported: monerod relies on IPv4 to make Sybil attacks harder. ^[8]

proxy-allow-dns-leaks defaults to false, which keeps DNS inside the proxy. Set it only if you know why you want the opposite. ^[10]

Confirm the Hidden Service Works

curl -x socks5h://127.0.0.1:9050 yourlongv3onionaddress.onion:18089/get_info

Restricted RPC, the Open Node Pattern

# ~/.bitmonero/bitmonero.conf

# Limited API on all interfaces
rpc-restricted-bind-ip=0.0.0.0
rpc-restricted-bind-port=18089

# Optional: advertise the node on the P2P network so wallets can discover it.
# This can consume a sizeable amount of resources.
#public-node=1

# TLS: enabled | disabled | autodetect
rpc-ssl=autodetect
#rpc-ssl-private-key=/path/to/key.pem
#rpc-ssl-certificate=/path/to/cert.pem

Do not combine restricted-rpc with rpc-restricted-bind-port. The reference notes that the pair leaves you with two restricted APIs and no unrestricted one. rpc-login sets the username[:password] required to connect to the API, and confirm-external-bind is the acknowledgement required when rpc-bind-ip itself is moved off localhost. ^[2]

Generate SSL Certificates

The reference points at the bundled monero-gen-ssl-cert tool for server key and certificate generation. A standard self-signed pair works too. ^[2]

openssl req -new -x509 -days 365 -nodes \
  -keyout monero-key.pem \
  -out monero-cert.pem \
  -subj "/C=XX/ST=XX/L=XX/O=XX/CN=monero"

Connect Your Wallet

Onion connections are end-to-end encrypted and authenticated by the address itself, which is what mitigates exit-node and clearnet interception. Over an onion address, TLS is optional. The GUI walkthrough writes the node address with a scheme prefix, and the daemon address is accepted in bare host:port form as well. ^{[8] [9]}

# GUI: Settings > Interface > Socks5 proxy   => 127.0.0.1 : 9050
# GUI: Settings > Node > Add remote node     => yourlongv3onionaddress.onion : 18089

# CLI over Tor
./monero-wallet-cli \
  --proxy 127.0.0.1:9050 \
  --daemon-address yourlongv3onionaddress.onion:18089 \
  --trusted-daemon

# CLI on the local network
./monero-wallet-cli --daemon-address 192.168.1.10:18089 --trusted-daemon

Format: [safe|fast|fastest]:[sync|async]:[nblocks_per_sync|nbytes_per_sync]. The default is fast:async:250000000bytes with an automatic switch to safe:sync near the chain tip. ^[2]

# Explicit fast mode for the initial sync
./monerod --db-sync-mode=fast:async:250000000bytes

# Most aggressive, most exposed to power loss
./monerod --db-sync-mode=fastest:async:250000000bytes

# Slow, crash-resistant writes
./monerod --db-sync-mode=safe:sync

System Optimization

# Increase file limits
ulimit -n 8192

# Add to /etc/security/limits.conf
* soft nofile 8192
* hard nofile 8192

# Swappiness for servers
echo "vm.swappiness=10" >> /etc/sysctl.conf

# Transfer limits in kB/s (defaults: 8192 up, 32768 down)
--limit-rate-up 512
--limit-rate-down 2048

# Connections (defaults: 12 outgoing, unlimited incoming)
--out-peers 8
--in-peers 8

Mining is off unless you turn it on. --start-mining takes a primary wallet address as its argument, not a switch, and it cannot be a subaddress or an integrated address. On a running daemon the equivalents are the start_mining and stop_mining commands. ^[2]

The maintained image is published to the GitHub container registry and built from Monero source on an Alpine base. The commands below are the maintainer's recommended usage. ^[11]

# Full node, restricted RPC only, no public advertisement
sudo docker run -d --restart unless-stopped --name monerod \
  -v bitmonero:/home/monero/.bitmonero \
  ghcr.io/sethforprivacy/simple-monerod:latest \
  --rpc-restricted-bind-ip=0.0.0.0 --rpc-restricted-bind-port=18089 \
  --no-zmq --enable-dns-blocklist --ban-list=/home/monero/ban_list.txt

# Pruned node
sudo docker run -d --restart unless-stopped --name monerod-pruned \
  -v bitmonero:/home/monero/.bitmonero \
  ghcr.io/sethforprivacy/simple-monerod:latest \
  --rpc-restricted-bind-ip=0.0.0.0 --rpc-restricted-bind-port=18089 \
  --no-zmq --enable-dns-blocklist --ban-list=/home/monero/ban_list.txt \
  --prune-blockchain

# Public open node: add --public-node to either command

Docker Compose

# docker-compose.yml
services:
  monerod:
    image: ghcr.io/sethforprivacy/simple-monerod:latest
    container_name: monerod
    restart: unless-stopped
    volumes:
      - bitmonero:/home/monero/.bitmonero
    ports:
      - "18080:18080"
      - "127.0.0.1:18089:18089"
    command: >
      --rpc-restricted-bind-ip=0.0.0.0
      --rpc-restricted-bind-port=18089
      --no-zmq
      --enable-dns-blocklist
      --ban-list=/home/monero/ban_list.txt
      --prune-blockchain

volumes:
  bitmonero:

Essential Commands

Commands run against the daemon that is already running. ^[2]

# Sync status, height and connection counts
./monerod status

# Sync progress with per-peer download and upload stats
./monerod sync_info

# Local height only
./monerod print_height

# Connected peers, incoming and outgoing
./monerod print_cn

# Blocks in a range. print_bc REQUIRES a begin height.
./monerod print_bc 3733000 3733010

# Peer list, and white vs grey peer statistics
./monerod print_pl
./monerod print_pl_stats

# Current consensus version and any scheduled fork height
./monerod hard_fork_info

# Network statistics
./monerod print_net_stats

Monitoring Script

#!/bin/bash
# monero-monitor.sh

while true; do
  clear
  echo "=== Monero Node Status ==="
  ./monerod status
  echo ""
  echo "=== Network Stats ==="
  ./monerod print_net_stats
  echo ""
  echo "=== Peer Counts ==="
  ./monerod print_pl_stats
  sleep 30
done

print_net_stats is registered in the daemon command table as "Print network statistics" and is not listed in the online reference. ^[12]

# Watch logs in real time
tail -f ~/.bitmonero/bitmonero.log

# Errors only
grep ERROR ~/.bitmonero/bitmonero.log

# Sync progress
grep "Synced" ~/.bitmonero/bitmonero.log | tail

# Connection issues
grep "Failed to connect" ~/.bitmonero/bitmonero.log

At log-level=0 the daemon keeps minimal logs and does not record peers or wallets connecting. Raising it to 1 temporarily is the documented way to understand what the node is doing. ^{[2] [6]}

# UFW (Ubuntu)
sudo ufw allow 18080/tcp   # clearnet P2P
sudo ufw allow 18089/tcp   # restricted RPC, only if you serve wallets
sudo ufw enable

# iptables: restricted RPC to the LAN only
sudo iptables -A INPUT -p tcp --dport 18080 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 18089 -s 192.168.1.0/24 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 18089 -j DROP

Port 18081 never appears in these rules on purpose. Checkpointing is a separate trust decision: --enforce-dns-checkpointing makes MoneroPulse emergency checkpoints binding, which the reference suggests for unattended nodes, while --disable-dns-checkpoints discards them. ^[2]

The official service runs the daemon as a dedicated unprivileged user with the blockchain, config and logs in separate directories. ^[4]

# System user and directories
useradd --system monero
mkdir -pm 750 /etc/monero /var/lib/monero /var/log/monero
chown root:monero /etc/monero
chown monero:monero /var/lib/monero /var/log/monero

# Binaries
mv monero-x86_64-linux-gnu-v0.18.5.1/* /usr/local/bin/.
chown root:root /usr/local/bin/monero*

# /etc/systemd/system/monerod.service
[Unit]
Description=Monero Daemon
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
ExecStart=/usr/local/bin/monerod --config-file /etc/monero/monerod.conf --non-interactive
Restart=always
RestartSec=30
User=monero
Group=monero
StandardOutput=journal
StandardError=journal

[Install]
WantedBy=multi-user.target

The paired config uses data-dir=/var/lib/monero/bitmonero and log-file=/var/log/monero/monero.log. --non-interactive matters in containers and under systemd, because monerod otherwise opens stdin and expects a tty. ^{[2] [4]}

systemctl daemon-reload
systemctl enable monerod
systemctl restart monerod
systemctl status monerod