Hi nusenu
I'm considering not setting OutboundBindAddress on the dotsrc exit relays (
https://metrics.torproject.org/rs.html#search/dotsrc). Wouldn't it be better if all outgoing connections came from the same IP (i.e do not set OutboundBindAddress), for the sake of making correlation analysis harder? Say you observe an exit connection to
example.com:443. If all the dotsrc relays used 185.129.61.1 as src IP, you couldn't tell which of our relays made the connection.
On a related note, wrt ongoing ddos, here's something that might be useful to exit relay operators:
What we observed, was tens of thousands open exit connections to a few IP (at one point our server had more than 500.000 open connections to those hosts!). To check if you see the same, here's a one liner to show you the endpoints with the largest number of connections from your server:
# ss -tn | tr -s ' ' | cut -d' ' -f 5 | sort | uniq -c | sort -nr | head
One way to solve this, is to do some firewall foo, but I really don't like connection tracking (unnecessary CPU cycles). An alternative solution that works great for us, is to lower the net.ipv4.ip_local_port_range from the default of about 30.000 ports. E.g:
# sysctl -w net.ipv4.ip_local_port_range="64000 65535"
This limits the number of connections you can have to a specific dst tuple (IP, Port) to 1.535 connections (and thanks to Tor now setting IP_BIND_ADDRESS_NO_PORT, reaching this limit won't affect any other connections as the same port can be used as src for many different dst IPs).
- Anders