diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1f058c8..b0a5d41 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
+### Added
+- added ability to exclude exit nodes via `EXCLUDE_EXIT_NODES` environment variable
 
 ## [4.3.1] - 2021-05-15
 ### Fixed
diff --git a/Dockerfile b/Dockerfile
index 96f29b4..3a9f715 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -11,6 +11,7 @@ VOLUME /var/lib/tor
 #RUN apk add --no-cache \
 #        less \
 #        man-db \
+#        strace \
 #        tor-doc=$TOR_PACKAGE_VERSION
 #ENV PAGER=less
 
diff --git a/README.md b/README.md
index 1dfd70d..9de8897 100644
--- a/README.md
+++ b/README.md
@@ -48,6 +48,12 @@ sudo iptables -A OUTPUT ! -o lo -j REJECT --reject-with icmp-admin-prohibited
 $ sudo docker run -e SOCKS_TIMEOUT_SECONDS=60 …
 ```
 
+### Exclude Exit Nodes
+
+```sh
+$ sudo docker run -e EXCLUDE_EXIT_NODES=1.2.3.4,1.2.3.5 …
+```
+
 ### Show Circuits
 
 ```sh
diff --git a/docker-compose.yml b/docker-compose.yml
index d33b781..d90b0c5 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -9,6 +9,7 @@ services:
     image: fphammerle/tor-proxy
     environment:
       SOCKS_TIMEOUT_SECONDS: 30
+      #EXCLUDE_EXIT_NODES: '{xx},{yy},1.2.3.4,128.0.0.0/1'
     volumes:
     - type: volume
       source: data
@@ -19,7 +20,7 @@ services:
       tmpfs:
         # nosuid,nodev,noexec added by default
         mode: '1777'
-        size: 4k
+        size: 5k
     read_only: yes
     ports:
     - '127.0.0.1:9050:9050/tcp'
diff --git a/entrypoint.sh b/entrypoint.sh
index e27762b..a8ed8c7 100755
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -20,4 +20,10 @@ else
     sed -e "s/{socks_timeout_seconds}/$SOCKS_TIMEOUT_SECONDS/" /torrc.template > /tmp/torrc
 fi
 
+if [ -z "$EXCLUDE_EXIT_NODES" ]; then
+    sed --in-place -e '/{exclude_exit_nodes}/d' /tmp/torrc
+else
+    sed --in-place -e "s#{exclude_exit_nodes}#$EXCLUDE_EXIT_NODES#" /tmp/torrc
+fi
+
 exec "$@"
diff --git a/torrc.template b/torrc.template
index 5c79cef..5a80590 100644
--- a/torrc.template
+++ b/torrc.template
@@ -26,5 +26,7 @@ SocksTimeout {socks_timeout_seconds}
 # https://github.com/mitmproxy/mitmproxy/blob/v6.0.2/mitmproxy/platform/linux.py#L27
 TransPort 0.0.0.0:9040 IsolateClientAddr IsolateClientProtocol
 
+ExcludeExitNodes {exclude_exit_nodes}
+
 # try to
 HardwareAccel 1