[tor-relays] Re: adaption of a DDoS prevention solution

[forest-relay-contact--- via tor-relays <tor-relays@xxxxxxxxxxxxxxxxxxxx>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Hello.

So far, this is what I have for IPv4 (without any persistence features,
so the sets disappear on restart), but I have nothing yet for IPv6
because I'm trying to figure out a better way to apply blocks with more
fine-grained comparisons than "/64 for Hetzner etc, /80 for IONOS etc".

  flush ruleset

  table inet filter {
      set tor_ddos {
          type ipv4_addr
          flags timeout
          timeout 24h
      }

      set tor_connlimit {
          type ipv4_addr
      }

      define tor_trusted = {
          # snowflake servers
          141.212.118.18,
          193.187.88.42,
          193.187.88.43,
          193.187.88.44,
          193.187.88.45,
          193.187.88.46,
          # directory authorities
          45.66.35.11,
          66.111.2.131,
          128.31.0.39,
          131.188.40.189,
          171.25.193.9,
          193.23.244.244,
          199.58.81.140,
          204.13.164.118,
          216.218.219.41,
          217.196.147.77
      }

      chain tor_input {
          ip saddr $tor_trusted accept
          ip saddr @tor_ddos log prefix "ddos-block " drop
          add @tor_connlimit {
              ip saddr ct count over 8
          } log prefix "excessive-connections " drop
          meter tor-ddos-fast {
              ip saddr timeout 2m limit rate over 8/minute burst 8 packets
          } add @tor_ddos { ip saddr } log prefix "add-ddos-fast " drop
          meter tor-ddos-slow {
              ip saddr timeout 1h limit rate over 16/hour burst 16 packets
          } add @tor_ddos { ip saddr } log prefix "add-ddos-slow " drop
          accept
      }

      chain input {
          type filter hook input priority filter; policy drop;

          iif lo accept
          ct state { established, related } accept
          ct state new jump {
              tcp dport 9001 tcp flags syn jump tor_input
              tcp dport 22 accept
          }

          icmp type echo-request limit rate 25/second accept
      }

      chain output {
          type filter hook output priority filter; policy accept;
      }

      chain forward {
          type filter hook forward priority filter; policy drop;
      }
  }
-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQQtr8ZXhq/o01Qf/pow+TRLM+X4xgUCal2ReQAKCRAw+TRLM+X4
xqQTAQCvT5L3BmfIkBUfP0wM28sTgUHKnPu0ixdElgOgOpSsZgEAwzOYh+CRdW9C
1lOzZZiu/PbBKoxB+NuPioKEXq30Egw=
=G2JJ
-----END PGP SIGNATURE-----
_______________________________________________
tor-relays mailing list -- tor-relays@xxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to tor-relays-leave@xxxxxxxxxxxxxxxxxxxx