Run a VPN Node and Earn TON per GB

• A Linux server with a public IPv4 address. x86-64 (amd64) only: the agent is not built for ARM servers today. Kernel 5.6 or newer, because WireGuard is built into the kernel from 5.6. At least 1 vCPU and 1 GB of RAM; 2 vCPU and 2 GB are recommended.
• Root access and a free TCP port 443. No web server or other VPN may already listen on it.
• Docker, or AlmaLinux / CentOS Stream 10+. The Docker mode runs on any distribution and installs Docker if it is missing. The systemd mode, without Docker, is for AlmaLinux and CentOS Stream 10 or newer.
• A TON wallet that supports TonConnect, such as Tonkeeper. It deposits your stake and receives your payouts. A wallet can be linked to one ProofKit account only.
• 1 TON per node in the escrow as stake, and about 0.1 TON left in the wallet to pay for claim transactions.

Exit node (origin). Runs Xray and WireGuard. It decrypts the user's tunnel and sends their traffic to the internet from your IP address, so abuse and copyright complaints about that traffic reach you and your hosting provider. Two switches help: Torrent Guard blocks BitTorrent, and Cloudflare WARP sends traffic out through Cloudflare instead of your IP. An exit always serves VLESS Reality; Hysteria2, XHTTP and olcRTC are optional.

Entry node (edge). Runs nginx as a TCP pass-through plus WireGuard, and never decrypts anything. Place it where users can still reach it when routes abroad are throttled, then link it to exit nodes: your own, or any exit whose operator accepts outside entries. Each exit decides who may link to it: anyone, listed operators, or only its owner's entries. If WireGuard is blocked between the two servers, switch the tunnel to GRE or GRE+IPsec.

One server runs one node type.

You set a price per GB for each node, from 0.001 to 100 TON. An exit node always has one; an entry node may be set to 0, and a route through it then costs what its exit costs. Users see it with the 20% network fee added, and the price is fixed into each session when the user connects, so a change applies to new sessions only. You can change a price once every 24 hours, and an increase can be at most three times the current price. Lowering it has no limit.

On a direct session you receive 80% of what the user is charged, and the platform keeps 20%. The charge is your price plus the fee, so per GB you receive 0.96 times your price (olcRTC traffic from 20 November 2026 earns 80% of the olcRTC price instead):

On a 2-hop route both the entry and the exit operator are paid from the same session, and your dashboard shows what each session earned. Upload and download both count, and a GB is 1024³ bytes.

How much traffic a node gets depends on its country, price, uptime and demand, and the network is young. Compare the countries and prices already listed in the marketplace before you choose yours, and do not plan around a fixed income.

Earnings show as pending on your Wallet page as users' traffic is billed. Once at least 0.02 TON is pending, press Claim earnings: the coordinator signs a batch claim covering up to 50 users, your wallet sends it to the escrow contract, and the contract takes those users' charges from their deposits, pays you 80% and keeps 20% as the platform fee. That is the same split your pending balance already shows.

Each claim is a transaction from your wallet that attaches about 0.06 TON for gas; the escrow contract sends back what the claim does not use, so a claim costs a few thousandths of a TON. Payouts go to the wallet linked to your operator account.

Registering a node locks 1 TON of your escrow balance as its stake; registration fails if your available balance is lower. Deleting the node releases the stake back to your balance, which you can withdraw. Claim a node's unclaimed earnings first: a node that still has them cannot be deleted.

The network checks every node: it makes test connections through the node's tunnel, cross-checks the bytes reported by the entry and the exit with each other and with WireGuard's kernel counters, and looks for statistical anomalies. Three or more critical flags on a node within 24 hours cost 10% of its stake, at most once per 24 hours.

Mark a node private and it disappears from the marketplace. Only people you invite can connect: send a one-time code, or a link that is reusable, limited to a number of uses, or set to expire. You can revoke anyone later. Private nodes bill and pay like public ones, and a private exit node has a price too, at least 0.001 TON per GB. More on the private node page.

olcRTC carries a user's traffic inside a video call on a public video-conferencing service, for networks where the other transports are blocked. It is optional and runs on exit nodes. Some of the services it can use need your own account there, which you connect in the dashboard; ProofKit keeps those credentials on a separate provisioning server and never shows them back. One service needs no account. Which services a node may use is set by the platform, node by node. olcRTC is metered like the other transports, carries UDP, and leaves from your server's own IP rather than through WARP. Until 20 November 2026 its traffic pays your price like any other; from then on it is charged at one network-wide olcRTC price per GB (a route priced at 0 stays free, olcRTC included), and you receive 80% of that price for the olcRTC traffic your node carries. Users need an olcRTC-capable client.

Day-to-day commands on a Docker-mode server: