# Subject: New restricted exit relay (HTTP/HTTPS only) received BadExit flag – seeking diagnosis

**URL:** https://forum.torproject.org/t/subject-new-restricted-exit-relay-http-https-only-received-badexit-flag-seeking-diagnosis/21787
**Category:** Relay Operator
**Created:** [June 26, 2026, 6:42pm UTC](https://forum.torproject.org/t/subject-new-restricted-exit-relay-http-https-only-received-badexit-flag-seeking-diagnosis/21787 "2026-06-26T18:42:49Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![kanishkbakshi](https://forum.torproject.org/letter_avatar_proxy/v4/letter/k/ea666f/32.png) [@kanishkbakshi](https://forum.torproject.org/u/kanishkbakshi)
#### Post date: [June 26, 2026, 6:42pm UTC](https://forum.torproject.org/t/subject-new-restricted-exit-relay-http-https-only-received-badexit-flag-seeking-diagnosis/21787/1 "2026-06-26T18:42:49Z")

</div>

Hello everyone,

I am a new Tor relay operator. I recently converted my relay into a **restricted exit relay** that only allows HTTP and HTTPS traffic (ports 80 and 443). I am using OLA Krutrim

After operating as an exit for just a few days, my relay was assigned the `BadExit` flag. I would greatly appreciate any help understanding why this happened and how to resolve it.

### Relay Information

- **Nickname:** kanishkbakshi
- **Fingerprint:** `5E31D455EB9E6ED5429EC682156DC38A3EBD0E1E`
- **Platform:** Tor 0.4.9.8 on Ubuntu 22.04
- **Provider:** A cloud VPS provider (Asia)
- **Current flags:** `BadExit Exit Fast HSDir Running Stable V2Dir Valid`
- **Uptime:** 45+ days (no restarts)
- **Consensus weight:** ~1600
- **Advertised bandwidth:** ~6.17 MiB/s

### Exit Policy

```auto
ExitPolicy reject *:25
ExitPolicy reject *:465
ExitPolicy reject *:587
ExitPolicy reject *:2525
ExitPolicy accept *:80
ExitPolicy accept *:443
ExitPolicy reject :

```

### Diagnostics Already Performed

**HTTP test:**

```auto
curl -I http://example.com

```

-\> `HTTP/1.1 200 OK`

**HTTPS test:**

```auto
curl -I https://example.com

```

-\> `HTTP/2 200`

**Google HTTPS test:**

```auto
curl -I https://www.google.com

```

-\> `HTTP/2 200`

**DNS test:**

```auto
host example.com

```

Returns valid IPv4 and IPv6 records.

**Tor logs:**

```auto
sudo journalctl -u tor --since "14 days ago" | grep -Ei "warn|error|exit"

```

Returns no warnings or errors.

**iptables:**  
Default OUTPUT policy is ACCEPT. No rules are blocking outbound HTTP/HTTPS traffic.

### Networking Setup

The VM uses a private IP address with a floating public IP. External checks confirm that the advertised OR address matches the public IP.

### Questions

1. Is there a reliable way to determine exactly what triggered the `BadExit` flag?
2. Could this have been caused by Tor’s exit scanners, or is it more likely related to my cloud provider’s networking configuration (floating IP / NAT)?
3. What additional diagnostics would you recommend?

Any insights, similar experiences, or suggestions would be very helpful.

Thank you in advance!  
kanishkbakshi