Entry — the node a device connects to (chosen by GeoDNS from the client's location). Relay — optional middle hop: the entry's tunnel to the exit passes through it. It holds no keys and clients never dial it. Exit — the node whose address websites see. Only exits rotate.