[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
[tor-relays] overhauled nftables implementation of DDoS prevention solution
- To: "tor-relays@xxxxxxxxxxxxxxxxxxxx" <tor-relays@xxxxxxxxxxxxxxxxxxxx>
- Subject: [tor-relays] overhauled nftables implementation of DDoS prevention solution
- From: Toralf Förster via tor-relays <tor-relays@xxxxxxxxxxxxxxxxxxxx>
- Date: Sun, 20 Sep 2026 17:03:22 +0200
- Cc: Toralf Förster <toralf.foerster@xxxxxx>
- List-id: "support and questions about running Tor relays (exit, non-exit, bridge)" <tor-relays.lists.torproject.org>
- Reply-to: "support and questions about running Tor relays (exit, non-exit, bridge)" <tor-relays@xxxxxxxxxxxxxxxxxxxx>
- Ui-outboundreport: notjunk:1;M01:P0:YrfxdzEFVQ0=;VzIrNUfRPQFbHE6qY1TZm63KmPw u+ZEWnofS42QSHDOYqdWZkXdmzDaSh+Ub+xMVa1nTd9qup6sRWMr+w8CUGYn80Hc0HPlbuENg dOxeFVG0CnUTwC8BA0I1jF+bGvpynNjuimxwS/L+TFE6Bh3/xW1V0bPHYMsDU0QnIFmqdxsf4 XNjdF5Di2/0xPwld8/v3c0E7MabJznnjx6+AOlGnv6TQL6DU2i5Qsy8T2d/4AKZX7x57mXDCV Ed8+GwmGpiIc05LlsEWbMesXPrd/A1yFt6Ue8pYPw5RjixIncASxFpTmnclPyQBZIe/wOtHEQ F5sxXhP5SNYEb1775PN+vhmXqXPm3Db0Nz/1fKSxf4jLQHhkoi1b0e4pTY703rTPpom/u6971 bRIZEjQ7ezd7YWHv9Oten2+mSru70EaDolS5aXvqAQz5MHt0BSp5p/Oyvz7D31nadtAF1eHhG oTXYY+MkUO8JVDXmee2XfqgK85WZ3uR4jXLiP2fMCQGiYvV98Pyu5d0hpC7AR5jG6Qr/eYPrB 9sFieBixitk06Jve1P7n1A4Q4Lvr3V7KYs3HsIeB2Nmrp0XqmZ1XqRthaYxC3sA+4RG3JjHNL yNRu97yUokzykVfwr0cN7UHSdV4AUJv5pTLmj++sNBq66Q9ly8v0DPzvEsiwnYvqNPQWHdGRw lOtzFpBhF/oV1zK2CHt/eDNz714pdw33TvjOA3aOEQkbbPx6oVJXMm6xxWsZ1s8LPYv/TCG94 of82F9GBfQZ/QD0OduYd0gUEFxowl1pRPz6z13fNSrIG0AW29LRx6RRROs6D+NeeqAQ6bNaT8 88PNpvz77p44QRkDSng5IQ8xRXL7GxYZTRgYx3TCOcKLkrOIZIrZ20gynWK4BBWoPIorF9BTP 81e7rU/ns7gG61mqpIUvZxiHs8rBQ5noaSdNpJHDlMJJvlal6XJyXoeAnGc08KQr8H6Hhu8a+ K/C7G1zcwRE6J+AdkMjbVknI+m3ZBJWKfvlWQp8mFRliYRkgTxbbnc8F1FWSNKXInpXhBcTyR opQJrhpCPnHhDD8m8DU/HIwpgVqD/AZuGlYdfW91Cdziwc6RagXLXXvF0vOZk0lBJmtj0fbER jKnkHesoSuB1kmD/JhsQsHxeaCUgT+9yHHVOVDE8qszO6vmQZZoVqGJK2nRqXvbkPfEcT8hsR ZwDJoqZn8184X8bms6tsW3BuRKtxkHASmj6/daXCO/rLLarCroqJp7+bTBYRvsXloTcuclWvt PH5MEHjQS5gXJeTRlz9rMfBQUYxSGoEsEF61H49Pg+/4jmBAboLNJxCYKQy2CRa3ZiDoodoTi H+D5UPuLYxuTYd6zxF6LTDIvkPRrX5gcePwTNOIhDqSWkwWZbHGX95kEi7onkaZF/2bkWorJA s+wdyDq6ikc5Aia/32ai1NTklbutaCz4DeOI+pGFJN5rDChbvWVQxfKZFbLJbDmriOhnperQ+ 7JoF3csh3WCV/BGwL1qqKLs6ZeiF9VszO+PABPUYl+wY9PbmL4GnCGj6DJcU5xPwGZi41cElw q7qEoeABBvTKuRu/ilxtg62m6kNq6ieq4LF2+jxB/XDebBp2j79UehfrBAjUeXDWxS6DRZ5Nd nGGDygrkOGbFzYS6CgeWeDy3SuWUL5swsYAjvNREJIWBWwyjvmL56OOaEM8vdYFQjSm5B5uDo osqOESWplJIZEJQ6Wu0Wnzq1yearpk3DNzhQqZUuH4k+hZ4/KGKdVfWlAH4EhfHQeTAEvwR/8 4F1SFqURzgJ1IuY5MAlWg6JGOPDm9xEZVvQwWpam3halnVi1jqXQEsbddfaiHRzgf9uQygGBG ZQ5oNHWDyY0f70sdotmFjiGwOlqWYY8CBWxA/riyfJfs2NS1jNAwK32EvcRXYKrzqzcWdcDZb G9ARaT8HwlKIrGZbfBcPLLx4OL+uMgDERiuuNyrgAWWC3pn8h3GeWu/SOhRP/kBGs5zV74OxC w2Kz5lXfghumrIuBuo66GKeoQujESxO7eZVnLvc9DmJiYv+hEOA1K07osBMoKD5HT4O+3SWMZ CI7vn0d1VTUdMSgftzAiKSj5wcgeSqZ0iaqFT8NbJx127uePDcjkPjmcMOBeWZX1U8hwLb+y3 0rQBrDnlHn0SZAT0AJcI7ys/32+2B1PbKra0UQJMkOacmtQmr2eUPhmfMr+kw8Ea/AIX/gNzz 2KXP05SgC3ioowvpQIgz2U8pziBI+ppl1KZBgFA+70iQo4aQsGlg8eYbdZqgs19JvU7Nutrwh +a/CU5vuqe7GWPt5RkaXraTnIFEOCAndaV/nnqyo+s5gp0HTk+hrJk05O2oigC6arijNxFp29 NwEzY8rn1NOipDFUTneEuUDAeIf1IncmWXLXf0JAkdBXJe0RVA+2RmqqNraa5sNeh8BoG7JLA dHwsJ6Ou+Bc/vxmATHDmY42Z/crbjv41i+t5MQMFnsjbrhlC6AW8LEfpVkerBbxfxpaT24V15 0ZWQMKDHdSX/Ye84T/8V3RG1Tmdz2xNPybztDEJ16KGbNfVhe+fq4XOqv5Jgaa54F5fj7QaXo WgMpLzgqZs07gEEWUGIYUSA1Zepcb6t1FJn0eQ3muGsMjMI44SRi89otwj4LWFJdMn7Ea1GZ/ lnY2ZYiFdZNdIkQnszfL9TgN3TVC51qBUK/O4asRh+oxkuSRqRUDGp/U4hkWKkRaijDxvL55x O5qjytuaSjQrKlTXxuD9izWnmmMROJtMt5z3BnfZZQekeY/+YqRt/VK22O+u7hKqXdGZSSBCp 1z7xc1h2c/fgJS8f/NwmYwa6OGumRFFHBePWG6bwKUSrSuLafV6m2TfgX7eIKjiknDfkItDxh AxzVx9wcPYNhr+Fbgf91rhlMxci29I20SoOXIhh8E3rVKefc5PYZ8KbolC0xBGWfE82t/zSAD 4/sDWg7wRET4xT9umhOCC0a1m2EkXPYk5/1oA/v5BAQaoqTJ1U4VMFpNJYOg3LmsmamJ1ENsU wlVK5zmhBj9ZnbAV9ha4/wdoVYnRm3uG4UaMmiIpjAAs1mN8pmkXsyHtgW0eBQDIHS0o4yt5m THFBP3lyucK9L3ZZ8Hi52xNgT5ZFHL/Nm5aZMsRSVClXBHJrOTIuWA9A2qix9aza7JXORyzRT FEs7IU5j7qFyrk+HM2AZBN5pX/OuN62wyTQY97+ie8cdLYq0JqzJLooySIWzmtUkzQWl3WZCt DA2JrFqtuvfEIlWl+xBKHl5OXEptky823Qfxvhu0j5YhmCyh4Js0lGmruIbhaYjPzNNPcaAbR 5NWa/WO/FqrcnbqXnEsLgkLZq1+mWjT5JGDPGi8/ITPTVduMkipURrGLo5Mp2QI/9Ybicmr63 JzEWEnWUtUJqpo94SKvKa1YmxPt+gOb3o5XMZMjqADR/Z8MjU2+WYOJ6U60pcNXhzWwNmrYon TcOJi2jScLhWjQdhwr/eYeowbWHvUPgCb/t/X0mBLfpb/ttonVLlQsR75oQQ+ruhjeydydFuC EkBCfbpdqjbAOKEnLfbbUxpqC/fgnGteJ3CRBFsVHlyE2kdB2DJyGzIg+sLn3oNE4e+8uu+zE Dj4ca+ZAjRIISBHbrQ9SeLQnCb4szRvdSO4cX1nBVsva76CQupuTZnSCy0VXmxhDOtTqGTAmC vr5Ox7ZWv14IM1QKUj1E1ICwpUerc3TdTxKoa7wXk+J+siMJqCKi6KP0pJvUWBfANLxrL2ca/ i6fJ+FkAmxhN4mozHPK1QrxH8/DVpE1gfkZfxJZOIXkt8vIrvk4YxWmq/Yj1PH3hZk/g0sz2B flL1BWJRw51yfJ+3cLhOjwxEhQDiVDqkaRIB5nvDPcCcqQLjOQuHuPzb9l0k7VOCSSirXzjnZ o4MO9gIrCdPdqCaFCYb3Tvl0DliWKDJUt0f90zWAUWFeY8gWnjTe1AlRVaD9bPD1Q92Cu5t3+ 35fvom9A4X8SzlgN4Qhtko2VoaNf7j3GXvQZZQ9oGAiBzu+9m7/DekGlpQw6UOilFQdp9L7rT RAHP1i4udxrUnpTCV3eEEsMgf9UPKHPxHgB43JE9jxEzaIeZc0zRSLF7AL/HHizIY8csovjHy 5n0dQ4BfPGuA78DIOpjdks0zI8fJkFaMB98Urm4KXwo7sam9gah3FKggCXTuIfNQRFNrvE+O1 pM3J5L8ymVRIdmmF6vk3FHt1qzZzHslUkmsybE8ZHV8jlWQnNvwY8U4XOHDIVUl5+ZBcJWCbH y/+8aBYHXHFGnnZ66sFJp11DWHI1PoYPSfU0JB1qmfezRovDojQy80BeZc2gOc1xNw2uVMXVk SxZRBxR8Yne5CN4fsDlcR1f0wJ3TOiBey/PIfUD12ohMUBg/4bjZVaJL1NSSs1sjTjW4i/q6p 9o9U7EDgg+uAx49Oo8XzAYrOIQJ8+aZqRY8OYZ9ouiH4uY1xAxjNmibrBcQXeZrfGmDnuCNgv CtTqiLCtUs8qWowE+FQiV/dFSqydKDH7HqYhvS1P3XIu8/949Sxr7zHN7KJ2+QsNm8NsVHPhV cwjwis+e1oGNSTU5QLhLqIrPA9FRPz2Mf7FYS7PEGFZ3UNaPTs/8owEVWMKRe4jmymNw0ACzf 89e2D1hGnqXcodNFvlZTuirSr3StHYjYeKNT2/yvwU/H/VdwI06sxLeEEPZOVCyKcuuA0ZGDu IOleh4bWVYKyngkDt+yRrpbsyklMsb8dBlb05869mKcH4yv8eYO9lp26q2qOU3bh6ZMRy4IXr uAj7GAsS5nsYmSy3XUdNpyJ2YZqYHPZF7NmONuCEbrSuOIPz3Je6h8GWico2K+NjDlrjc2UFp bTEcl6XhSHVxtUiNI1Z/MKzAkNoE/d/dv0wPQwv97XqtiMN8y4Mi/GcCI0Eb+HxQVM1tI/96p sfhAElgQJJ8pvjxBSxD4PWeKCRQ9Ke6ORm57NNrirLkHsSa53n8MHLX40gYQvhVj06cC7lDHV 3da0XRKevv0esL//tm/r9j16XI6rxqIKl5FJbySxrs2tKLyBDwFtSq93X+zoUzz3FT3q28xlf MV39UWSgAEWU8XAi4c3oCFIOsapbXp+Ju4Hf5eCzLPa17ZSEyaysrc5KyZaIRESwi4AL1B66w soxYw436BothvJD0Iiga+IswgkEbFgy3as14Sxn6M5rd+XdbRhaJSeFUbXxDQGGPdHD0myIN8 4AIOTwYxHVj+sCfWZwPVOa1jYUd7BJz4wGxnP0gFB6z3aKHezQz5BLNvgChA7M1CG+JNyIgoV zL0wxlSmFi80ExRsDLI3wakQ+QywxhIrumdyhoNb54D+Qug0x59KZbOjDLD9NPuEqJIx9qR1l B2v7kXv6mAVx4WBkrPyKVOnHttxO79dhvBmqMnSsAqkX/bXYvNwxhqlmCgSoYwUld8qrdtNdb 3IPjIXSuTUu6xF9coYX9ChUp5c9oha0HoxJxqHi+wotQtkGjTyFNTwXtrEHJy5JLpBZsVYtdp dqcM/GtGSi9nD+xbYKSVLq8Y3y5LUVoCuRpGIIilM8zydLZyfXVxYX4vfIwHfjJxR8ekiWxMq OKxRjt8LdFiK7eHm4vqMPeTVPEZBNK/R77hxI6iEKH6y/8+4gDZAiQuBRi6El/rMsBGaaPp++ rmaOed5wuNckQomdrCnLW1w1afS38oevaFPzRJ+wo1cO87kwzcbiiSFsPpJ/XXab0XC6DIfR+ WHuKzbiBt+tWwU/yIrjmzIfdiItwEo7ZHAGZJn8iXzjjckztfNie0WsUUxweQvNkFNBXRg4ZC ioygazETDzmSYusUWz+uwmH0IhImAJ+Ft/7gctWV6h+1Telloi62gQmHZxoyTTDJAdZ4KKCaq w5Rila3osaHBKL6YBzmddlqQwh9uK+uj2hdv+wTGOxqZTDns+5T7pSytTvBC6Wq4men+lOHSa 9tK+5kPDQnZ51BTKPdJVU+9Ojg2ohdt592/VoqiiX0riVvrR+Q6IZpjDBVyxH/A85Y7lkimji PPOA/G1PF74jUDU4UgTSmJt7wS7BqicafJnSuqSO/pB9IOft9ZYU/OYmKK4lNriPp6yVRzr6y M+Il0ZElvOm7Bc9Tq0x1sgyQpQvlrufDwRGzZrz2XyGoVt8LmFgSK8VPUbUIXUsAz4TRUdCxt bsM+wIEgpGF5AaD2cEXFNQ7adFeaE/is3nL/Qe/+AR+BtglAyHWew5lbdri9Q1T2N6npfF2Rd z6bHrUDyTyboxw0tqrivNmm0fqR8JhnUzV8z7PHJ722LRNwQO9dYBMDiRtTJNrdlO9A+I/gyc OusDoeVEMJ4KwPKPjfHkzQDlBf300nvvxLKq7sco245PfsZCT20MA==
- User-agent: Mozilla Thunderbird
The template [1] works now both for a straight forward Tor instance as
well as for machine hosting many Tor instances in parallel. Therere no
dedicated firewwall rules per Tor instance. The memory foot print is
reduced.
And, to avoid wrong abuse complaints from an over-reacting IDS I
re-implemented the existing solution [2] in nftables [3].
Will continue to maintain iptables and nftables implementations of the
ruleset [4].
As of today metrics show few dozen blocked addresses at a couple of tiny
VPS relays, but a high 3-digit number at a bare metal server hosting 5
relays, drop rate is about 40 p/s here. Much higher values were observed
in the past.
Feedback appreciated.
--
Toralf
[1] https://github.com/toralf/torutils/blob/main/nftables-ingress.conf
[2] https://github.com/toralf/torutils/blob/main/ipv4-rules-egress.sh
[3] https://github.com/toralf/torutils/blob/main/nftables-egress.conf
[4] https://github.com/toralf/torutils#the-rule-set
_______________________________________________
tor-relays mailing list -- tor-relays@xxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to tor-relays-leave@xxxxxxxxxxxxxxxxxxxx