Monero Remote Node vs Your Own Node: Privacy Risks and VPS Setup
A Monero remote node sees your IP, sync timing and which outputs you request. Learn the risks of public nodes and how to run your own restricted RPC node on a VPS.
Short answer: a Monero remote node never gets your keys or balance, but it does see your IP address, when your wallet syncs, which outputs your wallet fetches to build ring signatures, and the moment you broadcast a transaction. Running your own node, for example a pruned `monerod` with `--restricted-rpc` on a VPS, removes that third party, and adding Tor hides your home IP from the VPS as well.
This guide explains what a remote node can learn, why public nodes are a weak link, how much disk a pruned or full node needs in 2026, and how to set up a restricted RPC node that Feather, Cake Wallet and monero-gui can connect to. For the full node walkthrough without the remote-access angle, see our Monero node guide.
What a Monero remote node learns about you
A normal Monero wallet (Feather, Cake Wallet, monero-gui, monero-wallet-cli) keeps its view and spend keys locally. It downloads blocks from the node and scans them on your device, so the node cannot see your balance. It still sees plenty of metadata.
| Data | Visible to a remote node? | Why it matters |
|---|---|---|
| Your IP address | Yes | Links wallet activity to your connection and rough location unless you use Tor or a VPN. |
| Sync timing and frequency | Yes | Shows when you open your wallet and from which IP, which helps build a usage profile. |
| Outputs requested for rings | Yes | When you send, the wallet asks the node for ring member outputs; the real spend is hidden among them, but the request pattern can leak hints to a malicious node. |
| Transaction broadcast | Yes | The node is the first to see your transaction and knows the IP it came from. |
| View key, spend key, balance | No | Normal wallets scan locally. Light-wallet servers that ask for your view key are a different, more revealing model. |
Risks of using public remote nodes
- ▹Anyone can run a public node, including people collecting IP-to-transaction mappings. You cannot verify their logging.
- ▹A malicious node can feed your wallet manipulated data, such as an outdated view of the chain or skewed output lists for decoy selection. Current wallets include defenses, but your own node removes the question.
- ▹Clusters of public nodes run by one operator can correlate many users at once.
- ▹Public nodes go offline or get overloaded, which leaves your wallet stuck at sync.
- ▹Using a public node over clearnet ties your home IP to every send. If you must use one, connect over Tor and prefer a node you have some reason to trust.
Disk and RAM: pruned vs full Monero node (2026)
Sizes below are approximate as of late 2026 and grow every month. Check the current blockchain size before you pick a disk, and leave headroom for growth and the OS.
Note · On NoctisNode, the Nocturne plan (8 vCPU, 8 GB RAM, 100 GB NVMe) is the only VPS that can hold a pruned Monero node, and margins are thin, so check the current pruned size first and monitor disk usage. A full node does not fit on any current VPS plan, and dedicated servers are currently sold out. See Monero VPS options and paying with XMR.
| Node type | Approx. disk (2026) | RAM | Notes |
|---|---|---|---|
| Pruned (`--prune-blockchain`) | roughly 80–100 GB | 2–4 GB | Keeps about 1/8 of prunable data. Fully validates and serves wallets normally. |
| Full (unpruned) | roughly 250 GB or more | 4 GB+ | Needed if you want to serve full history to other nodes. |
| Initial sync | same as above | more helps | NVMe matters most; sync on spinning disks is painfully slow. |
Install monerod on a Debian or Ubuntu VPS
- 01.Create a dedicated system user so the daemon never runs as root.
- 02.Download the official CLI release from getmonero.org and verify its SHA-256 hash against the GPG-signed `hashes.txt`.
- 03.Install `monerod` to `/usr/local/bin`, write a config file, and add a systemd unit.
- 04.Open the P2P port (18080) and the restricted RPC port (18089) in the firewall, then start the service and wait for sync.
- 05.Harden SSH before leaving the server exposed; see [SSH hardening](/guides/ssh-hardening).
sudo apt update && sudo apt install -y wget bzip2 ufw
sudo useradd --system --create-home --home-dir /var/lib/monero --shell /usr/sbin/nologin monero
cd /tmp
wget -O monero-linux-x64.tar.bz2 https://downloads.getmonero.org/cli/linux64
wget https://www.getmonero.org/downloads/hashes.txt
sha256sum monero-linux-x64.tar.bz2 # must match the linux64 line in hashes.txt
tar xjf monero-linux-x64.tar.bz2
sudo install -m 0755 monero-x86_64-linux-gnu-*/monerod /usr/local/bin/
sudo mkdir -p /etc/monero
# /etc/systemd/system/monerod.service
[Unit]
Description=Monero daemon
After=network-online.target
Wants=network-online.target
[Service]
User=monero
Group=monero
ExecStart=/usr/local/bin/monerod --config-file=/etc/monero/monerod.conf --non-interactive
Restart=on-failure
TimeoutStopSec=120
[Install]
WantedBy=multi-user.targetRestricted RPC config: --restricted-rpc, --rpc-bind-ip, --prune-blockchain
Every command-line flag can go in the config file without the leading dashes. `restricted-rpc` disables admin calls (stopping the daemon, changing peers, mining), so a wallet can sync and broadcast but cannot control your node. `rpc-bind-ip=0.0.0.0` exposes RPC on all interfaces, which monerod refuses unless you also set `confirm-external-bind`. `prune-blockchain` keeps disk use down, and `sync-pruned-blocks` downloads already-pruned blocks to speed up the first sync.
After saving the file, run `sudo systemctl daemon-reload && sudo systemctl enable --now monerod`, then check progress with the last command below. Wallets work best once `synchronized` is true.
# /etc/monero/monerod.conf
data-dir=/var/lib/monero
prune-blockchain=1
sync-pruned-blocks=1
p2p-bind-ip=0.0.0.0
p2p-bind-port=18080
restricted-rpc=1
rpc-bind-ip=0.0.0.0
rpc-bind-port=18089
confirm-external-bind=1
# optional: require a login (Feather, Cake and monero-gui support it)
# rpc-login=walletuser:long-random-password
no-igd=1
enable-dns-blocklist=1
# firewall
sudo ufw allow OpenSSH
sudo ufw allow 18080/tcp
sudo ufw allow 18089/tcp
sudo ufw enable
# sync status
curl -s http://127.0.0.1:18089/get_info | grep -E '"height"|"target_height"|"synchronized"'Connect Feather, Cake Wallet and monero-gui to your node
- ▹Feather: open the network/node settings, choose to use a custom node, and add `your-server-ip:18089` (or the `.onion` address). Add the username and password if you set `rpc-login`.
- ▹Cake Wallet: go to the connection and sync settings, open node management, add a new Monero node with your IP or hostname and port 18089, then select it.
- ▹monero-gui: in Settings, open the Node tab, choose Remote node, add your address and port 18089, and set it as the active node. Enter login details if required.
- ▹monero-wallet-cli: start it with `--daemon-address your-server-ip:18089` and, if needed, `--daemon-login walletuser:password`.
- ▹Menu names change between releases; if a label differs, look for node, daemon or connection settings.
Optional: reach your Monero node over Tor
Your own node on a VPS removes the third-party operator, but the VPS still sees your home IP every time the wallet connects. Publishing the RPC port as a Tor onion service hides that. With Tor-only access you can set `rpc-bind-ip=127.0.0.1`, drop `confirm-external-bind`, and remove the `ufw allow 18089/tcp` rule so RPC is not reachable on the clearnet at all.
Feather has Tor built in. On Android, Cake Wallet can route through Orbot, and monero-gui can use a local SOCKS5 proxy such as `127.0.0.1:9050` from the Tor service. More detail on onion services is in our Tor hidden service guide.
sudo apt install -y tor
# append to /etc/tor/torrc
HiddenServiceDir /var/lib/tor/monero-rpc/
HiddenServicePort 18089 127.0.0.1:18089
sudo systemctl restart tor
sudo cat /var/lib/tor/monero-rpc/hostname # your .onion addressFAQ
QCan a Monero remote node see my balance?
ANo. A standard Monero wallet scans blocks locally with your view key, so the remote node never receives your keys or balance. It does see your IP address, sync timing, requested outputs and transactions you broadcast.
QIs it safe to use a public Monero remote node?
AIt is safe for your funds but weak for privacy, because an unknown operator can log your IP and transaction timing. Use it over Tor if you must, or run your own node.
QHow much disk does a pruned Monero node need in 2026?
ARoughly 80–100 GB as of late 2026, versus roughly 250 GB or more for a full node. Both grow continuously, so check the current size and leave headroom.
QWhat does --restricted-rpc do in monerod?
AIt limits the RPC interface to calls wallets need, such as syncing and broadcasting, and blocks administrative commands. Use it whenever the RPC port is reachable by anyone other than you on localhost.
QWhat is the default port for a Monero restricted RPC node?
APort 18089 is the common convention for restricted public RPC, while 18081 is the default unrestricted RPC port and 18080 is P2P. Any port works as long as the wallet and firewall match.