Run your own Monero node on a VPS

Why self-host a Monero node

When you open most Monero wallets, they connect to a public remote node run by someone else. That node can’t steal your funds and can’t break Monero’s on-chain privacy — ring signatures, stealth addresses and RingCT still do their job. But the node does see the requests your wallet makes and the IP they come from. That is a metadata seam worth closing.

Running your own monerod removes the middleman. Your wallet queries a daemon you control, so no third party learns which outputs you’re scanning for or when you’re online. You also stop being a pure consumer of the network: a synced node validates every block and relays transactions, adding one more independent verifier to Monero. A VPS is the natural home for it — always on, on a fixed connection, and paid for in Monero with no KYC on our end.

Download and verify monerod

Never run a coin daemon you haven’t verified. The Monero project publishes a signed hashes.txt; check the archive against it before you extract anything.

# on a fresh Ubuntu VPS
cd /tmp
# download the CLI tarball + the signed hashes file from getmonero.org/downloads
# import the maintainer signing key, then:
gpg --verify hashes.txt        # must say: Good signature from the Monero key
sha256sum -c <(grep 'monero-linux-x64' hashes.txt)   # OK = archive matches
tar -xvf monero-linux-x64-*.tar.bz2
sudo install monero-x86_64-linux-gnu-*/monerod /usr/local/bin/

If the GPG line doesn’t say Good signature or sha256sum doesn’t print OK, stop and re-download. A tampered daemon defeats the entire point of self-hosting.

Run it pruned, with the RPC locked down

Pruning is the single biggest disk saver. A pruned node still checks every block — it just drops most historical ring data it doesn’t need to keep — so it’s the right default for a wallet backend. Bind the RPC to localhost so nothing on the public internet can poke it.

monerod \
  --prune-blockchain \
  --data-dir /srv/monero \
  --rpc-bind-ip 127.0.0.1 \
  --rpc-bind-port 18081 \
  --no-igd \
  --detach
# watch progress:
tail -f /srv/monero/bitmonero.log

The P2P port (18080) is what lets your node talk to peers and pull blocks; it’s fine to allow it. The RPC port is the sensitive one — that’s what your wallet talks to, and it must never be open to the world. Keep it on 127.0.0.1, and if you need to reach it from your laptop, tunnel over SSH or expose it as a Tor onion service rather than opening the port in your firewall.

Let it sync, then point your wallet at it

The first sync is the slow part: the node downloads and validates the full chain from genesis, which is CPU- and disk-bound. Let it run to completion — it’s a one-time cost. Once monerod reports it’s synchronised, connect a wallet:

# CLI wallet talking to your local daemon
monero-wallet-cli --daemon-address 127.0.0.1:18081

# or the same daemon reached over an SSH tunnel from your laptop:
ssh -N -L 18081:127.0.0.1:18081 user@your-vps
monero-wallet-cli --daemon-address 127.0.0.1:18081

Running over Tor

To keep your node’s IP out of the peer-to-peer gossip, route its outbound traffic through Tor. Install tor on the box and start monerod with a transaction proxy so broadcasts don’t reveal your originating address:

monerod \
  --prune-blockchain \
  --data-dir /srv/monero \
  --rpc-bind-ip 127.0.0.1 \
  --tx-proxy tor,127.0.0.1:9050 \
  --no-igd --detach

For inbound reachability over Tor you can also publish an --anonymous-inbound onion address, which lets other privacy-conscious nodes connect to you without either side learning a clearnet IP. If you’re already comfortable with hidden services, the same pattern that hosts a Tor relay applies here.

Sizing

The Monero blockchain is large and still growing, so disk is the constraint, not CPU or RAM. That’s why this use case maps to the Pro plan: a pruned node wants tens of GB today and steadily more over time, and a full archival node wants considerably more. Give yourself headroom so an unattended daemon never runs the volume to zero mid-block. A modest core count and a few GB of RAM are plenty; the disk is what you’re paying for.

What this page is and isn’t

This is a guide to hosting your own validating node for your own wallet. It isn’t financial advice, and running a node doesn’t anonymise a transaction that was already deanonymised elsewhere. We rent you a private, no-KYC server with the disk to hold the chain; the node, the keys, and the wallet stay entirely yours.