This screenshot, from an article linked below, shows what I'm talking about. The blacked out parts next to "Portugal", "Germany", and "United States" cover publicly routable IP addresses (afaik):
I think I may be able to help sort out the confusing bits. I know a lot about Tor so if you have any further questions feel free to ask. Sp332's comment is a good explanation so I will simply expand upon it. Also, if I misunderstood your question let me know.
Tor works by ensuring that there is three Tor relays between the Tor client (the software that connects to the Tor network) and the destination the Tor client is connecting to.
However, what happens when you want to establish a connection between two hosts who are both using Tor through the Tor network? Well, in that case both Tor programs establish a path through three Tor relays and link the last Tor relays in each of their separate chains together (if you are interested in learning about how each Tor program knows the others end point look up "Tor hidden service directory"). Now with both ends of their Tor relay chains linked, both hosts can communicate with each other securely and anonymously over the Tor network. (For example: you are using Tor browser to connect to a hidden service. Both Tor browser and the hidden service make a chain of three Tor relays each and connect the chains together through the last node of each chain. The Tor browser only knows the relays that it uses for its chain + the end of the hidden services chain. The hidden service only knows the relays in its chain + the last relay in your chain. Thus keeping you both anonymous.)
Yes, thank you; that explains it. I somehow got the impression that the last three relays were routed on, effectively, a different layer of the Tor network than public Internet IP routing, one that didn't rely on the public IP addresses.
The screenshot shows the traffic going through 3 Tor relays (which your browser knows the public IP addresses of, since it created that circuit in the first place) followed by three more Tor relays (which it doesn't know the public IP addresses of, since that circuit was created by the hidden service), followed by a final hop to the hidden service.
This screenshot, from an article linked below, shows what I'm talking about. The blacked out parts next to "Portugal", "Germany", and "United States" cover publicly routable IP addresses (afaik):
https://www.jamieweb.net/blog/forwarding-tor-hidden-services...
Also, note that I had it backward in the parent: The traffic first goes through publicly routable IPs, then through Tor relays.