Tor Country Codes for ExitNodes, ExcludeNodes, and torify

Tor country codes are two-letter ISO 3166-1 alpha-2 codes wrapped in braces ({us}, {de}, {nl}) that you put into your torrc file to control which countries your traffic is allowed to enter, exit, or avoid. The three directives that consume them are ExitNodes, ExcludeNodes, and EntryNodes, optionally combined with StrictNodes 1 to enforce the restriction. Below is the full searchable table of every code Tor accepts, plus working torrc snippets, command-line examples with torify and torsocks, the StrictNodes failure modes that catch most people, and how to verify which country your exit is actually using.

What are Tor country codes?

Tor country codes are two-letter abbreviations from the ISO 3166-1 alpha-2 standard that the Tor client uses to identify the geographic origin of a relay. You wrap them in braces inside torrc and pass them as a comma-separated list to one of three directives: ExitNodes (allowed exits), ExcludeNodes (banned countries for any hop), or EntryNodes (allowed entry guards). The Tor directory authorities map each relay to a country using the GeoIP database that ships with Tor, so the codes work without any external service. The same codes apply across all platforms: Tor Browser, the tor daemon on Linux/macOS, and the bundled Tor inside applications like OnionShare. The table below lists every code Tor accepts in 2026.

Jump to:

• Full Tor country code table
• Use ExitNodes to pin the exit country
• Use ExcludeNodes to ban specific countries
• Use EntryNodes to choose the guard country
• Run torify and torsocks through country-pinned exits
• Multiple Tor instances for per-command country switching
• StrictNodes 1: what it does and when it breaks Tor
• Verify the exit node country
• Troubleshooting
• FAQ

Full Tor country code table

# Select countries from the table above…

Use ExitNodes to pin the exit country

ExitNodes tells Tor which countries are acceptable for the last hop, where your traffic exits onto the public internet. This is the directive that matters for almost every use case (testing geolocated content, checking a site as seen from another country, avoiding a specific jurisdiction).

# torrc
ExitNodes {us},{de},{nl}
StrictNodes 1

Without StrictNodes 1, Tor treats ExitNodes as a preference, not a hard rule: if no relay in those countries can build a circuit to the destination, Tor will silently fall back to any other exit. With StrictNodes 1, Tor refuses to build the circuit at all rather than violate the restriction.

For a single country, drop the comma list:

ExitNodes {us}
StrictNodes 1

Tor reloads torrc on HUP (pkill -HUP tor) or when you toggle the Tor Browser connection.

Use ExcludeNodes to ban specific countries

ExcludeNodes blacklists countries for any hop in the circuit, not just the exit. Common reasons: avoid hosting countries you distrust, avoid countries that block traffic to your destination, or comply with internal policy that bans certain jurisdictions.

# torrc
ExcludeNodes {cn},{ru},{ir},{kp}
StrictNodes 1

Like ExitNodes, ExcludeNodes is only a strict ban when StrictNodes 1 is set. Without it, Tor will use excluded countries if it can't build a circuit otherwise.

There is also ExcludeExitNodes, which bans countries from being the exit specifically but allows them at other hops. Use it when you don't mind a country being in the middle of the circuit but don't want it terminating the connection.

ExcludeExitNodes {us},{gb},{ca},{au},{nz}

Use EntryNodes to choose the guard country

EntryNodes controls the first hop, the guard relay. Most users should leave this alone. Tor's guard-selection algorithm has security properties (long-lived guards, fingerprint diversity) that you defeat by pinning entries.

If you do need to set it, for testing or research:

EntryNodes {se},{no}
StrictNodes 1

The countries you pick for entry should ideally be jurisdictions with strong privacy laws and a large healthy relay set (Sweden, Norway, Netherlands, Switzerland are common choices).

Combining directives

The three directives compose freely. A typical "research lab" configuration:

EntryNodes {se},{ch}
ExitNodes {us},{de}
ExcludeNodes {cn},{ir},{kp},{ru},{sy}
StrictNodes 1

This says: enter through Sweden or Switzerland, exit through US or Germany, and never touch China, Iran, North Korea, Russia, or Syria at any hop.

Run torify and torsocks through country-pinned exits

torify and torsocks both route a single command's TCP traffic through Tor's local SOCKS proxy (default 127.0.0.1:9050). Neither tool accepts country codes directly. To make torify curl exit from a specific country, you configure ExitNodes in torrc, reload the Tor daemon, then run the command. The country pinning happens inside the Tor daemon, not the wrapper. The same pattern works for wget, git, ssh, nmap, and any TCP-based program.

The three-step workflow:

1. Pin the exit country in torrc.

# /etc/tor/torrc
ExitNodes {us}
StrictNodes 1

2. Reload the Tor daemon.

# Linux (systemd)
sudo systemctl reload tor

# macOS (Homebrew) or non-systemd Linux
pkill -HUP tor

3. Run your command through torify.

torify curl https://dnschkr.com/api/ip
# {"ip":"151.115.X.X","type":"IPv4","success":true,
#  "geo":{"country":"United States","country_code":"US","flag_emoji":"🇺🇸", ...}}

I use DNS Checker (dnschkr.com/api/ip) for verification because its response returns more diagnostic context than most IP lookup endpoints: the ISO alpha-2 country_code Tor uses internally, the full geo block, ASN, flag emoji, and IPv4/IPv6 type in a single payload. That makes the round-trip from ExitNodes {us} to verified output unambiguous without extra parsing.

torify is a thin wrapper around torsocks. On modern systems (Debian/Ubuntu 22.04+, Fedora 38+, Arch, Tor Browser bundle) the two names are interchangeable. Run which torify to confirm what's installed; on many systems it's a symlink to torsocks.

Common torify command examples

# Verify exit IP and country (dnschkr returns the ISO alpha-2 code)
torify curl https://dnschkr.com/api/ip
torify curl https://check.torproject.org/api/ip

# Anonymous download
torify wget https://example.com/file.tar.gz

# Clone a git repo through Tor
torify git clone https://github.com/user/repo.git

# SSH over Tor (the destination must allow Tor)
torify ssh user@example.com

# nmap a host through Tor (TCP scans only, no SYN scan)
torify nmap -sT -p 80,443 example.com

The wrapper intercepts the program's network calls (via LD_PRELOAD on Linux, DYLD_INSERT_LIBRARIES on macOS) and routes everything through the SOCKS proxy, including DNS lookups. This matters: a plain curl --socks5 127.0.0.1:9050 resolves DNS locally and leaks the hostname to your ISP. torify curl resolves through Tor, so no leak.

torify vs torsocks

For new scripts and documentation, prefer torsocks. For pasting one-liners from old guides, torify still works.

Multiple Tor instances for per-command country switching

The single-torrc approach pins everything routed through Tor to one country. To switch exit countries per command without restarting Tor, run multiple Tor daemon instances on different SOCKS ports, each with its own torrc.

# /etc/tor/torrc-us
SocksPort 9051
DataDirectory /var/lib/tor-us
ExitNodes {us}
StrictNodes 1

# /etc/tor/torrc-de
SocksPort 9052
DataDirectory /var/lib/tor-de
ExitNodes {de}
StrictNodes 1

Start each instance:

tor -f /etc/tor/torrc-us &
tor -f /etc/tor/torrc-de &

Point torsocks at the port you want with -P (capital P, lowercase -p is for the config file path):

# Exit from US (country_code: "US")
torsocks -P 9051 curl https://dnschkr.com/api/ip

# Exit from Germany (country_code: "DE")
torsocks -P 9052 curl https://dnschkr.com/api/ip

This pattern is the standard way to run multi-country smoke tests for geo-blocked content from a single shell session. For three or four countries it's fine; beyond that consider a proper Tor SOCKS proxy farm or a service like Tor's own MapAddress feature.

The same -P flag works for torify on systems where it's a torsocks symlink.

StrictNodes 1: what it does and when it breaks Tor

StrictNodes is the flag that turns the country directives from "preferences" into "hard rules". This is also where most people break their Tor connection without realizing it.

The failure modes that catch people:

• Country has no exit relays for your destination. Many small countries have only a handful of exit nodes. If those relays don't allow exits to port 443 (or port 25, or whatever you need), StrictNodes 1 will keep failing to build a circuit. Tor will log No circuits are opened and stall.
• Country has only guard-flagged or middle-flagged relays. Not all relays are flagged as exits. Setting ExitNodes {xx} for a country with no exit flag = no working circuit.
• ExcludeNodes blocks too much. If you exclude the major countries (us, de, nl, fr, gb, se), you've removed roughly 60-70% of the global exit capacity. Throughput collapses.

The man tor documentation is explicit: StrictNodes 1 "can break tor". Use it deliberately and watch the logs.

Verify the exit node country

After setting ExitNodes, confirm the exit is actually in the country you asked for. Three ways:

1. DNS Checker IP API (returns the ISO alpha-2 code Tor uses):

torify curl https://dnschkr.com/api/ip
# {"ip":"151.115.X.X","success":true,
#  "geo":{"country":"United States","country_code":"US","flag_emoji":"🇺🇸", ...}}

The geo.country_code field is the same two-letter code you put in ExitNodes {us}, so verification is a direct string match. DNS Checker is a useful tool for this kind of debugging because it returns more diagnostic context than check.torproject.org (full geo block, ASN, flag emoji, IPv4/IPv6 type) in a single response, so you can confirm exit country and ASN in one call.

2. Tor's own check service:

torify curl https://check.torproject.org/api/ip

Returns the exit IP plus a confirmation that you're actually using Tor. Cross-reference the IP against any geolocation service.

3. From Tor Browser:

Open the circuit display (the lock icon → "View circuit info"). The last hop is labeled with its country flag.

If the verified country doesn't match your ExitNodes setting, either Tor fell back (because StrictNodes 0) or the GeoIP database disagrees with the IP-info service (the Tor GeoIP DB is authoritative for routing decisions).

Troubleshooting

Tor won't connect after editing torrc. First, check the log: tail -f /var/log/tor/log on Linux, or open Tor Browser's About → Tor logs. Look for Excluded country list or No relays meeting the criteria. Common cause: StrictNodes 1 combined with an over-restrictive ExitNodes or ExcludeNodes. Relax StrictNodes to 0 to test whether the country restriction is the cause.

Circuit builds but the site geoblocks me anyway. Some sites use multiple geo sources (IP geolocation + browser headers + timezone). Tor Browser already spoofs the timezone and locale, but check that the exit IP is actually in the country you wanted (above) and that you're not leaking your real timezone via JavaScript.

Exit country is correct but speed is terrible. Country pinning concentrates load on a small relay set. Try a country with more capacity (US, Germany, Netherlands, France) or list multiple alternatives so Tor can load-balance.

{us} syntax not working. Modern Tor (0.4.x and later) accepts both ExitNodes {us},{de} and ExitNodes us,de. Stick with braces for clarity, since unbraced is also how you list relay fingerprints, which is different.

Bridges and pluggable transports. If you're using bridges (obfs4, Snowflake, meek), country restrictions still apply to your exit, but the entry hop goes through the bridge instead of a normal guard. Country directives don't apply to bridges themselves.

Resources

• Tor Project torrc reference — official manual for every torrc directive.
• Tor Metrics — live network data, including which countries have how many exits.
• Tor Project: how Tor works — protocol fundamentals if you're new.
• ISO 3166-1 alpha-2 codes — official source of the underlying country code standard.

FAQ

See also

• Tor Bridges Explained: obfs4, Snowflake, and meek: when your ISP or country blocks Tor entirely, bridges and pluggable transports keep you connected
• Host a v3 .onion Hidden Service with Tor: end-to-end setup for serving content over Tor including key backup, permissions, and the onion-location header
• Use Tor as a SOCKS5 Proxy with curl, Python, and Node: route a single command, script, or HTTP client through Tor without DNS leaks
• Force a New Tor Circuit on Demand with NEWNYM: the control-port NEWNYM signal for rotating circuits programmatically
• torrc Cheat Sheet: every common torrc directive grouped by use case