Entry — the node a device connects to (chosen by GeoDNS from the client's location). Relay — optional node in front of the entry: clients dial it on UDP/443 and it forwards to the entry, holding no keys. Exit — the node whose address websites see. Only exits rotate.