On Thu, Aug 18, 2022 at 06:19:06PM +0200, lists@for-privacy.net wrote:
On Mittwoch, 17. August 2022 19:31:48 CEST Logforme wrote:
I run the relay 8F6A78B1EA917F2BF221E87D14361C050A70CCC3
I have tried to mitigate the current DoS by implemented connection limits in my iptables using Toralf's template: More than 25 connection during 10 mins and you end up on my naughty list. Lots of connection attempts from the naughty list dropped but still my relay gets "overloaded"
However, I have noticed that a few relays also end up on the naughty list, and I wonder how that can happen. My understanding is that a relay will only open 1 connection to another relay so should therefore never end up on the list. Correct?
10, 20 or more users can have set up the circuits using the same relays. kantorkel's Article10 relays have more than 100 connections per IP to me.
On my smaller relays I allow 100 connections per IP: https://privatebin.deblan.org/?b4768471c3c9e7ef#EhDETgMKQRvpL6VwH7ABE3bN2cuM...
But I can't use that on the big servers because Linux kernel “conntrack” tables and nftables sets only have 65535 entries. See: The dark side of using conntrack https://blog.cloudflare.com/conntrack-tales-one-thousand-and-one-flows/
Is your 65535 limit self-imposed? I'm running a server, that is not Tor related, on Linux where I was hitting conntrack table limits so I increased the limit by setting net.nf_conntrack_max=500000 since I have memory to spare.
As far as I'm aware, there is no hard limit in the kernel as long as you have memory for it.
D767979FE4C99D310A46EC49037E9FE7E3F64E9D is a particularly frequent naughty boy.
;-) It is very, very unlikely that there is a naughty relay in AS680. That relay most likely does DNS-, BW- or network healing test in the Tor network. https://metrics.torproject.org/rs.html#search/as:AS680 (German university or research institutes)
I guess my real question is if these connections are legit and I'm hurting the Tor network by using connection limits?
Yes, never block other relays. If you think there is somewhere a malicious relay, report it on bad-relay or in this list.
-- ╰_╯ Ciao Marco!
Debian GNU/Linux
It's free software and it gives you freedom!
tor-relays mailing list tor-relays@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays