[tor-relays] Re: DDoS solution for Tor nodes - nftables variant implemented

[Toralf Förster via tor-relays <tor-relays@xxxxxxxxxxxxxxxxxxxx>]

On 13/09/2026 11:22, forest via tor-relays wrote:
>    chain tor_kill_established {
>            type filter hook input priority filter - 1; policy accept;
>
>            ct state established tcp dport 9001 jump {
>                    ip saddr & $mask4_24 @tor_ddos4 drop
>                    ip6 saddr & $mask6_64 @tor_ddos6 drop
>            }
>    }

IMO this breaks the ruleset in a silent way - visible only after 24 
hours of runtime.

The origin ([1]) blocks for *at least* 1 day after the last malicious 
packet arrived (see [2] too) whereas the variant above blocks for only 1 
day after the first packet arrived.


[1] https://github.com/toralf/torutils#the-rule-set
[2] https://github.com/toralf/torutils/blob/main/nftables-ingress.conf#L157

--
Toralf
_______________________________________________
tor-relays mailing list -- tor-relays@xxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to tor-relays-leave@xxxxxxxxxxxxxxxxxxxx