<html><head></head><body><div style="font-family: Verdana;font-size: 12.0px;"><div>
<div>Yes you are right.</div>
<div>But to concentrate exit relays on some specific networks / ISP is also a bad idea.</div>
<div> </div>
<div>I disabled all known traffic logs for daily usage. Only during ssh sessions to check rules.</div>
<div>I use selective rules to block botnets / trojans. I double check all IP's to not blocking important servers (hopefully).</div>
<div> </div>
<div>It is not my aim to break client connections, but we should not close our eyes to potential problems.</div>
<div> </div>
<div>
<div name="quote" style="margin:10px 5px 5px 10px; padding: 10px 0 10px 10px; border-left:2px solid #C3D9E5; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<div style="margin:0 0 10px 0;"><b>Gesendet:</b> Mittwoch, 16. September 2015 um 18:51 Uhr<br/>
<b>Von:</b> "Johan Nilsson" <jn@9999.se><br/>
<b>An:</b> tor-relays@lists.torproject.org<br/>
<b>Betreff:</b> Re: [tor-relays] Preventing wp-admin related abuse report</div>
<div name="quoted-content">On Tue, Sep 15, 2015 at 22:36:27 +0200, butary@gmx.de wrote:<br/>
> So I decided to go a controversial way - I installed an IDS/IPS +<br/>
> strong firewall rules.<br/>
> The log file contains a huge amount of rejected traffic. Most of the<br/>
> time, Botnet traffic and shortly rising WordPress attacks.<br/>
><br/>
> I'm not happy with my decision but it smoothed my ISP because they<br/>
> received less abuse reports.<br/>
><br/>
You log traffic and block addresses with a firewall based on what<br/>
the IDS/IPS consider bad?<br/>
Please stop and consider running a middle relay or bridge instead of<br/>
logging and breaking connections for clients.<br/>
<br/>
> If someone has a more elegant solution, please advice me.<br/>
Try to educate or change ISP. Exits can unfortunately not be operated<br/>
from all networks.<br/>
<br/>
Exit operators could try to maintain an (incomplete) list of addresses<br/>
that often causes complains for traffic from exits. They could choose<br/>
to block them using torrc. Might help a little with the ISP if the<br/>
complains does not come repeatedly from the same source.<br/>
But traffic would move to fewer exits and they would get more<br/>
complains. This is probably a bad idea and not a solution. Worse than<br/>
not running an exit to some destinations from that network? I do not<br/>
know.<br/>
<br/>
Regards,<br/>
Johan<br/>
_______________________________________________<br/>
tor-relays mailing list<br/>
tor-relays@lists.torproject.org<br/>
<a href="https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays" target="_blank">https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays</a></div>
</div>
</div>
</div>
<div> </div>
<div class="signature"> </div></div></body></html>