<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><meta content="text/html;charset=UTF-8" http-equiv="Content-Type"></head><body ><div style='font-size:10pt;font-family:Verdana,Arial,Helvetica,sans-serif;color:#000000;'><div ><div>More specifically, I’m running a middle relay on Debian 12</div><div><br></div><div><div></div></div> <br> </div><div class="zmail_extra_hr" style="border-top-width: 1px; border-top-style: solid; border-top-color: rgb(204, 204, 204); height: 0px; margin-top: 10px; margin-bottom: 10px; line-height: 0px;"></div> <br> <div class="replyHeader">---- On Tue, 09 Jul 2024 13:46:51 +0200 lists@for-privacy.net<lists@for-privacy.net> wrote ----</div><div><br></div><blockquote style="border-left: 0px; padding-left: 0px; margin-left: 0px;"> <div>On Montag, 8. Juli 2024 19:34:51 CEST Rafo (r4fo.com) via tor-relays wrote: <br>> But this week I’ve received 2 DDoS alerts from my provider <br>> (Netcup), both are ~3 gigabits. They seem to be coming from other Tor <br>> relays.I’m running an Invidious like instance on my server (which uses <br>> around 600 megabits) but I have a 2.5 gigabit port. So I configured my Tor <br>> relay to use 300-400 megabits.I’m not sure where that 3 gigabit of data <br>> comes from.I have lowered my advertised bandwidth to 100 megabits, would <br>> that be enough to prevent these kind of issues?Kind regards,Rafo <br> <br>Reducing the advertised bandwidth does not help. ;-) In general, one tor <br>instance will rarely reach 100 megabits. <br> <br>There is little you can do on the server against targeted DDoS. But you can <br>stop IPs with a lot of connections to your tor daemon using dynamic exit <br>police¹ or dyn. IP/nftable rules². For targeted help, you should specify the <br>type of relay you have and your OS. <br> <br><a href="https://gitlab.torproject.org/tpo/community/support/-/issues/40093" target="_blank">https://gitlab.torproject.org/tpo/community/support/-/issues/40093</a> <br> <br>¹<a href="https://github.com/artikel10/surgeprotector" target="_blank">https://github.com/artikel10/surgeprotector</a> <br> <br>²<a href="https://forum.torproject.org/t/is-tor-network-resistant-to-tcp-syn-flood-dos-attacks-from-outside-of-tor/12690/4" target="_blank">https://forum.torproject.org/t/is-tor-network-resistant-to-tcp-syn-flood-dos-attacks-from-outside-of-tor/12690/4</a> <br> <br>-- <br>╰_╯ Ciao Marco! <br> <br>Debian GNU/Linux <br> <br>It's free software and it gives you freedom!_______________________________________________ <br>tor-relays mailing list <br><a href="mailto:tor-relays@lists.torproject.org" target="_blank">tor-relays@lists.torproject.org</a> <br><a href="https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays" target="_blank">https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays</a> <br></div> </blockquote></div><br></body></html>