Re: [tor-relays] DoS attack on Tor exit relay

[<gerard@xxxxxxxxxxxx>]

Can we have your fail2ban scripts for the OR port?  The jail and rules?

Gerry

-----Original Message-----
From: tor-relays <tor-relays-bounces@xxxxxxxxxxxxxxxxxxxx> On Behalf Of teor
Sent: 01 August 2019 00:28
To: tor-relays@xxxxxxxxxxxxxxxxxxxx
Subject: Re: [tor-relays] DoS attack on Tor exit relay

Hi,

> On 1 Aug 2019, at 02:27, Larry Brandt <lbrandt@xxxxxxx> wrote:
> 
> Yes, I have fail2ban installed but the attack is focused on my ORPort
9001.  Similarly, I have an external firewall but it permits 9001 port
passage.

If you're trying to prevent too many connections, you can adjust the DoS
torrc options:
DoSConnectionEnabled 1
DoSConnectionMaxConcurrentCount 1
DoSConnectionDefenseType 2

If that works, try adjusting DoSConnectionMaxConcurrentCount a bit
higher: 10 or 25 are good values.

T

--
teor
----------------------------------------------------------------------


_______________________________________________
tor-relays mailing list
tor-relays@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays