[tor-relays] Re: Abnormal Firewall-States since 0.4.9.10

[via tor-relays <tor-relays@xxxxxxxxxxxxxxxxxxxx>]

Yeah, this matches what a bunch of us have been seeing.

The elevated state counts were already climbing in the days before 0.4.9.10, so the version bump itself doesn’t look like the trigger. Timing lines up with the circuit-building DoS wave that’s been running since late June (the one that pushed overload-general from the usual 2-3 % up past 12 % of the network). A full state table is just the same saturation taken one step further — once you hit the limit nothing new can connect and the relay drops offline for a while, exactly like the multi-hour outage some people reported.

Contabo ranges are definitely carrying a big chunk of it. Same pattern others mentioned: lots of IPs from the same /24s, none of them relays, each holding 50–250 connections. That’s consistent with the current DoSConnectionMaxConcurrentCount limit being enforced per Tor process rather than per host — spin up a few instances on one VPS and you can park a few hundred connections from a single source without ever tripping the defense. Feels like a real gap.

On the practical side, if you’re on FreeBSD/pf and still have headroom, just raise the state limit and turn on syncookies once you cross a threshold. That kept things usable for me even when the table was well into the hundreds of thousands. “Sloppy” states on the ORPort rules can also quiet the BAD State noise if you’re seeing sequence complaints. MetricsPort is worth turning on so you can watch the actual onionskin drops and connection counters instead of guessing from the heartbeat numbers. Restarting clears the pile-up for a bit, but the connections come right back while the wave is still going.

Longer term the real fixes have to come from Tor itself (host-wide connection caps, better idle circuit cleanup under pressure, aggregate rate limits, etc.). Those are already being talked about, so hopefully something lands before this becomes the new normal.

Annoying as hell, but at least the relay itself is still doing its job once the firewall stops choking.
_______________________________________________
tor-relays mailing list -- tor-relays@xxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to tor-relays-leave@xxxxxxxxxxxxxxxxxxxx