<div dir="ltr"><div>Hi Chris</div><div><br></div><div>>
Not at all. That's how I'm running my own relays. Just run the<br>> **combined.sh** on each individual VM and you'll be fine.</div><div><br></div><div>We do not run VMs. We run 12 Tor instances on a single host, and use ORPort <a class="gmail_plusreply" id="plusReplyChip-0">+</a> OutboundBindAddress to separate them. I.e:</div><div><span style="font-family:monospace"></span></div><div><span style="font-family:monospace">root@tor-exit:/etc/tor/instances# grep 'OutboundBindAddress\|ORPort' */torrc<br>dotsrcExit1/torrc:ORPort <a href="http://185.129.61.1:443">185.129.61.1:443</a><br>dotsrcExit1/torrc:ORPort [2001:67c:89c:702:1ce:1ce:babe:1]:443<br>dotsrcExit1/torrc:OutboundBindAddress 185.129.61.1<br>dotsrcExit1/torrc:OutboundBindAddress [2001:67c:89c:702:1ce:1ce:babe:1]<br>dotsrcExit10/torrc:ORPort <a href="http://185.129.61.10:443">185.129.61.10:443</a><br>dotsrcExit10/torrc:ORPort [2001:67c:89c:702:1ce:1ce:babe:10]:443<br>dotsrcExit10/torrc:OutboundBindAddress 185.129.61.10<br>dotsrcExit10/torrc:OutboundBindAddress [2001:67c:89c:702:1ce:1ce:babe:10]<br>dotsrcExit2/torrc:ORPort <a href="http://185.129.61.2:443">185.129.61.2:443</a><br>dotsrcExit2/torrc:ORPort [2001:67c:89c:702:1ce:1ce:babe:2]:443<br>dotsrcExit2/torrc:OutboundBindAddress 185.129.61.2<br>dotsrcExit2/torrc:OutboundBindAddress [2001:67c:89c:702:1ce:1ce:babe:2]<br>dotsrcExit3/torrc:ORPort <a href="http://185.129.61.3:443">185.129.61.3:443</a><br>dotsrcExit3/torrc:ORPort [2001:67c:89c:702:1ce:1ce:babe:3]:443<br>dotsrcExit3/torrc:OutboundBindAddress 185.129.61.3<br>dotsrcExit3/torrc:OutboundBindAddress [2001:67c:89c:702:1ce:1ce:babe:3]<br>dotsrcExit4/torrc:ORPort <a href="http://185.129.61.4:443">185.129.61.4:443</a><br>dotsrcExit4/torrc:ORPort [2001:67c:89c:702:1ce:1ce:babe:4]:443<br>dotsrcExit4/torrc:OutboundBindAddress 185.129.61.4<br>dotsrcExit4/torrc:OutboundBindAddress [2001:67c:89c:702:1ce:1ce:babe:4]<br>dotsrcExit5/torrc:ORPort <a href="http://185.129.61.5:443">185.129.61.5:443</a><br>dotsrcExit5/torrc:ORPort [2001:67c:89c:702:1ce:1ce:babe:5]:443<br>dotsrcExit5/torrc:OutboundBindAddress 185.129.61.5<br>dotsrcExit5/torrc:OutboundBindAddress [2001:67c:89c:702:1ce:1ce:babe:5]<br>dotsrcExit6/torrc:ORPort <a href="http://185.129.61.6:443">185.129.61.6:443</a><br>dotsrcExit6/torrc:ORPort [2001:67c:89c:702:1ce:1ce:babe:6]:443<br>dotsrcExit6/torrc:OutboundBindAddress 185.129.61.6<br>dotsrcExit6/torrc:OutboundBindAddress [2001:67c:89c:702:1ce:1ce:babe:6]<br>dotsrcExit7/torrc:ORPort <a href="http://185.129.61.7:443">185.129.61.7:443</a><br>dotsrcExit7/torrc:ORPort [2001:67c:89c:702:1ce:1ce:babe:7]:443<br>dotsrcExit7/torrc:OutboundBindAddress 185.129.61.7<br>dotsrcExit7/torrc:OutboundBindAddress [2001:67c:89c:702:1ce:1ce:babe:7]<br>dotsrcExit8/torrc:ORPort <a href="http://185.129.61.8:443">185.129.61.8:443</a><br>dotsrcExit8/torrc:ORPort [2001:67c:89c:702:1ce:1ce:babe:8]:443<br>dotsrcExit8/torrc:OutboundBindAddress 185.129.61.8<br>dotsrcExit8/torrc:OutboundBindAddress [2001:67c:89c:702:1ce:1ce:babe:8]<br>dotsrcExit9/torrc:ORPort <a href="http://185.129.61.9:443">185.129.61.9:443</a><br>dotsrcExit9/torrc:ORPort [2001:67c:89c:702:1ce:1ce:babe:9]:443<br>dotsrcExit9/torrc:OutboundBindAddress 185.129.61.9<br>dotsrcExit9/torrc:OutboundBindAddress [2001:67c:89c:702:1ce:1ce:babe:9]<br>dotsrcRelay1/torrc:ORPort <a href="http://130.225.244.90:443">130.225.244.90:443</a><br>dotsrcRelay1/torrc:ORPort [2001:878:346:1cf9:446a:c4eb:4548:7061]:443<br>dotsrcRelay1/torrc:OutboundBindAddress 130.225.244.90<br>dotsrcRelay1/torrc:OutboundBindAddress [2001:878:346:1cf9:446a:c4eb:4548:7061]<br>dotsrcRelay2/torrc:ORPort <a href="http://130.225.244.90:9001">130.225.244.90:9001</a><br>dotsrcRelay2/torrc:ORPort [2001:878:346:1cf9:446a:c4eb:4548:7062]:9001<br>dotsrcRelay2/torrc:OutboundBindAddress 130.225.244.90<br>dotsrcRelay2/torrc:OutboundBindAddress [2001:878:346:1cf9:446a:c4eb:4548:7062]<br></span></div><div><span style="font-family:monospace"><br></span></div><div><span style="font-family:monospace">root@tor-exit:~# ip -br a<br>lo UNKNOWN <a href="http://127.0.0.1/8">127.0.0.1/8</a> ::1/128 <br>eth0@if11 UP <a href="http://130.225.244.90/30">130.225.244.90/30</a> <a href="http://130.225.254.114/27">130.225.254.114/27</a> <a href="http://185.129.61.1/24">185.129.61.1/24</a> <a href="http://185.129.61.2/24">185.129.61.2/24</a> <a href="http://185.129.61.3/24">185.129.61.3/24</a> <a href="http://185.129.61.4/24">185.129.61.4/24</a> <a href="http://185.129.61.5/24">185.129.61.5/24</a> <a href="http://185.129.61.6/24">185.129.61.6/24</a> <a href="http://185.129.61.7/24">185.129.61.7/24</a> <a href="http://185.129.61.8/24">185.129.61.8/24</a> <a href="http://185.129.61.9/24">185.129.61.9/24</a> <a href="http://185.129.61.10/24">185.129.61.10/24</a> 2001:67c:89c:702:1ce:1ce:babe:10/48 2001:67c:89c:702:1ce:1ce:babe:9/48 2001:67c:89c:702:1ce:1ce:babe:8/48 2001:67c:89c:702:1ce:1ce:babe:7/48 2001:67c:89c:702:1ce:1ce:babe:6/48 2001:67c:89c:702:1ce:1ce:babe:5/48 2001:67c:89c:702:1ce:1ce:babe:4/48 2001:67c:89c:702:1ce:1ce:babe:3/48 2001:67c:89c:702:1ce:1ce:babe:2/48 2001:67c:89c:702:1ce:1ce:babe:1/48 2001:878:346::114/48 2001:878:346:1cf9:446a:c4eb:4548:7062/48 2001:878:346:1cf9:446a:c4eb:4548:7061/48 fe80::216:3eff:fed5:6809/64 <br></span></div><div><span style="font-family:monospace"><br></span></div><span style="font-family:monospace">root@tor-exit:~# ss -s<br>Total: 139982<br>TCP: 148318 (estab 128481, closed 8757, orphaned 527, timewait 8744)<br><br>Transport Total IP IPv6<br>RAW 1 0 1 <br>UDP 247 193 54 <br>TCP 139561 125849 13712 <br>INET 139809 126042 13767 <br>FRAG 0 0 0 </span><div><br></div><div>It would be really nice if you could update the scripts to support this kind of setup! And maybe also consider using plain nftables instead of relying on the legacy iptables compatibility layer :)<br></div><div><br></div><div>Best regards</div><div>Anders<br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Dec 1, 2022 at 6:42 PM Chris <<a href="mailto:tor@wcbsecurity.com">tor@wcbsecurity.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hi Andres,<br>
<br>
Not at all. That's how I'm running my own relays. Just run the<br>
**combined.sh** on each individual VM and you'll be fine.<br>
<br>
As for the ORPort, yes, I agree. There are ways to read the torrc file<br>
and set the ORPort automatically. I will incorporate that into the<br>
scripts in future versions. My original intention was to put something<br>
simple together with minimum complexity that anyone with little or no<br>
expertise can understand and modify if necessary without breaking the code.<br>
<br>
I've also set up a [Discussion<br>
Board](<a href="https://github.com/Enkidu-6/tor-ddos/discussions" rel="noreferrer" target="_blank">https://github.com/Enkidu-6/tor-ddos/discussions</a>) for the<br>
repository on github in case you have any questions, suggestions or<br>
simply need further help.<br>
<br>
<br>
On 12/1/2022 11:57 AM, Anders Trier Olesen wrote:<br>
> Hi Chris<br>
><br>
> We run all the 12 dotsrc relays on a single host with many IP<br>
> addresses. Would we need to change anything?<br>
><br>
> Btw, you can make the scripts find the all the OR ports by running<br>
> something like ‘ss -pl | grep tor’.<br>
><br>
> - Anders<br>
><br>
> tor. 1. dec. 2022 kl. 09.02 skrev Chris <<a href="mailto:tor@wcbsecurity.com" target="_blank">tor@wcbsecurity.com</a><br>
> <mailto:<a href="mailto:tor@wcbsecurity.com" target="_blank">tor@wcbsecurity.com</a>>>:<br>
><br>
> Background:<br>
><br>
> A set of bash scripts used to apply iptables rules to fight the<br>
> current<br>
> DDoS attacks. They require no dependencies to install except<br>
> iptable/nftables which all Linux flavors already have and require no<br>
> particular expertise. The issue was discussed here:<br>
><br>
> [issue<br>
> 40093](<a href="https://gitlab.torproject.org/tpo/community/support/-/issues/40093" rel="noreferrer" target="_blank">https://gitlab.torproject.org/tpo/community/support/-/issues/40093</a>)<br>
><br>
> Change log:<br>
><br>
> Some modifications due to a change in the nature of the attacks.<br>
><br>
> - Re ordered rules for more efficiency and reducing the load<br>
> - Removed the hashlimit rule as it puts more load on the system<br>
> with not<br>
> much overall benefit as the attackers have adapted to it and it<br>
> reduces<br>
> the size of the block list.<br>
> - Reduce the number of allowed concurrent connections to 2 if<br>
> you're not<br>
> a relay.<br>
> - Use of remove.sh cron script at regular intervals (optional)<br>
> will give<br>
> relays a chance to create up to 4 connections if they need to.<br>
> ******- Created a new cron file **refresh-authorities.sh** to refresh<br>
> your allow-list with the most up to date IP addresses for the<br>
> authorities and snowflake. Should be run daily.<br>
> - Removed an unnecessary line in the update files.<br>
> - Modified Readme.MD file to reflect new changes.<br>
><br>
> The new modifications have been tested for two weeks now and the<br>
> systems<br>
> are running smoothly with no ill effect.<br>
><br>
> You can read more and download here:<br>
><br>
> [Enkidu-6 tor-ddos on Github](<a href="https://github.com/Enkidu-6/tor-ddos" rel="noreferrer" target="_blank">https://github.com/Enkidu-6/tor-ddos</a>)<br>
><br>
> To avoid occasional NTor drops a minimum NumCPUs 16 in torrc is<br>
> recommended.<br>
><br>
> P.S.<br>
> The NumCPUs option is unfortunately poorly documented. It really has<br>
> nothing to do with the number of CPUs you have. It's about the<br>
> number of<br>
> worker threads Tor will create to deal with decryption of<br>
> onionskins. So<br>
> you can have two CPUs and still set NumCPUs to 16.<br>
><br>
><br>
> _______________________________________________<br>
> tor-relays mailing list<br>
> <a href="mailto:tor-relays@lists.torproject.org" target="_blank">tor-relays@lists.torproject.org</a><br>
> <mailto:<a href="mailto:tor-relays@lists.torproject.org" target="_blank">tor-relays@lists.torproject.org</a>><br>
> <a href="https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays" rel="noreferrer" target="_blank">https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays</a><br>
><br>
</blockquote></div>