<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><br></div><div><blockquote type="cite"><div>Dennis Ljungmark:<br><blockquote type="cite">Hi,<br></blockquote><blockquote type="cite"> We're currently running 6 different 100-200Mbit relay/guard nodes, and<br></blockquote><blockquote type="cite">are looking at some issues moving on towards high performant exit nodes.<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"> There are some administrative issues ( needing another IP block due to<br></blockquote><blockquote type="cite">the RIPE registration, our ISP doesn't want their name on the exit nodes<br></blockquote><blockquote type="cite">that we are responsible for )<br></blockquote><blockquote type="cite"> which are generally minor ( are being resolved anyhow ) and then the big<br></blockquote><blockquote type="cite">stumbling block.<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"> Right now, with iptables modifications ( raw tables hacks to disable<br></blockquote><blockquote type="cite">conntrack, bucket increases, following the general best practices ) our<br></blockquote><blockquote type="cite">firewall is running at high amounts of CPU, but coping. However, once we<br></blockquote><blockquote type="cite">start introducing Exit Nodes into this equation, things turn sour.<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">So, since we do not want to trust only routing level separation between<br></blockquote><blockquote type="cite">Exit Nodes and internal networks, we're going to have to invest into new<br></blockquote><blockquote type="cite">hardware that can cope with this. Before this, we tried Ingate firewalls,<br></blockquote><blockquote type="cite">and they weren't capable of coping with the load of guard nodes.<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"> ( The traditional "linux box in front" doesn't quite cut it due to<br></blockquote><blockquote type="cite">networking hardware in most cases. )<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">So,<br></blockquote><blockquote type="cite"> in summary, when you get to the point of actively dealing with 8-900Mbps<br></blockquote><blockquote type="cite">of Tor traffic ( on top of normal users and others) what hardware is needed<br></blockquote><blockquote type="cite">to cope with firewalling?<br></blockquote><blockquote type="cite"><br></blockquote><br>Hey Dennis,<br><br>What hardware are you using? In general iptables/netfilter should be<br>able to handle more than 200Mb without any trouble at all.<br><br>I wonder if your network card is an issue? What CPUs are you using? What<br>versions of OpenSSL and other relevant software are in use?<br><br>All the best,<br>Jacob<br><br></div></blockquote>Also tweaking a few sysctls and playing around with txqueuelen will help.</div><div>See <a href="https://www.torservers.net/wiki/setup/server">https://www.torservers.net/wiki/setup/server</a>. I'll add some more stuff to the high bandwidth part of that page in a minute, also. I've done some more tweaking towards gbit that certainly helped, which I haven't documented yet.</div><div><br></div><div>Julian</div><br></body></html>