Hello everyone,
I'm looking to set up a reverse proxy for my onion site so that it can be accessed from both the darknet and clearnet. My goal is for users who request the domain on the clearnet to get the site originally hosted on the darknet. However, I'm a bit lost since Nginx doesn't support onion sites.
If anyone has experience with this or can provide guidance, I would greatly appreciate it. Additionally, are there any services available that can help obscure the reverse proxy, similar to Cloudflare, but perhaps utilizing botnets like a fast flux network? (that is paid with crypto ofc)
Thanks in advance for your help!
To securely bridge an onion service to the clearnet using a reverse proxy, a multi-layered approach is required to prevent deanonymization risks. First, configure your Tor hidden service in the torrc file to forward traffic to a local web server (e.g., Nginx or Apache) while ensuring that logs are minimal and no direct clearnet connections occur. On a separate clearnet VPS, install Tor as a client to act as a middleman, allowing Nginx to retrieve onion content. The Nginx reverse proxy should route clearnet requests through Tor with a proxy_pass directive pointing to the .onion address while setting strict security headers, disabling WebRTC and JavaScript logging, and ensuring no real IP leakage occurs in forwarded requests. To further harden security, use iptables rules to restrict outgoing traffic to only Tor circuits, preventing accidental clearnet leaks. For domain protection, self-hosted Anycast DNS and decentralized alternatives like HandShake (HNS) or I2P could help mitigate traffic correlation risks, while CDN-like fronting techniques such as running an intermediate VPS with a rotating exit IP can obscure the final proxy’s origin. For obfuscation, Meek, Snowflake, or obfs4 bridges could be used to blend Tor traffic with regular HTTPS connections, making it harder to identify as a hidden service proxy. Finally, implementing TLS on both the clearnet proxy and the onion service ensures end-to-end encryption while preventing fingerprinting from SSL mismatches. With these measures in place, the setup achieves a resilient and stealthy link between the darknet and clearnet while minimizing exposure risks.
Google it. What I used to use is the first result and there is a StackExchange post giving a few options.
I know there exists a reverse proxy for dark web sites on I2P. Its called an "in proxy" and there is i2phides.me, which will route those who do not have an I2P router installed on their devices to the dark web site. As iOS devices are yet to officially support I2P, this is very useful way to make a hidden service on the I2P dark web accessible to every Internet user.