Hi, Still having load trouble on your relay? Try dropping rapid connection attempts. > On 9 Jan 2018, at 16:32, teor <teor2345@xxxxxxxxx> wrote: > > I've tried various ways of limiting Tor's RAM and CPU. > MaxAdvertisedBandwidth was effective, as was limiting Tor's file > descriptors and DisableOOSCheck 1. MaxMemInQueues had a minor impact. > > So I decided to use a firewall to limit connections. > > ... > > So I set up this firewall rule: > > /sbin/iptables -A INPUT -p tcp --syn ! --dport 22 -m connlimit --connlimit-above 100 -j DROP > > You should replace 22 with the list of ports you use for SSH and other > important connections, just in case. > > And I installed iptables-persistent to save the rules. > (It might be Debian-specific). > > After I set up the firewall, the connections slowly dropped from 700 > down to around 100. It only affects new connections, so it might take > a while. This worked well, but Tor was still using a lot of CPU with its OOS checks. And it was using 4GB of RAM, which is good, but not sustainable on my machine. Today, I added these firewall rules to drop rapid connection attempts from the same IP address, even if there are under 100 connections: iptables -I INPUT -p tcp --syn ! --dport 22 -m state --state NEW -m recent --set iptables -I INPUT -p tcp --syn ! --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 100 -j DROP They drop connection attempts after there have been 100 attempts in a minute. So if there were 100 clients, that would be 1 connection per client per minute. This reduced Tor's CPU usage and OOS warnings within a few minutes. I'm hoping RAM will go down over time. I made the rules permanent using: iptables-save > /etc/iptables/rules.v4 This might be Debian-specific. T -- Tim / teor PGP C855 6CED 5D90 A0C5 29F6 4D43 450C BA7F 968F 094B ricochet:ekmygaiu4rzgsk6n ------------------------------------------------------------------------
Attachment:
signature.asc
Description: Message signed with OpenPGP
_______________________________________________ tor-relays mailing list tor-relays@xxxxxxxxxxxxxxxxxxxx https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays