Hi,
Still having load trouble on your relay? Try dropping rapid connection attempts.
On 9 Jan 2018, at 16:32, teor teor2345@gmail.com wrote:
I've tried various ways of limiting Tor's RAM and CPU. MaxAdvertisedBandwidth was effective, as was limiting Tor's file descriptors and DisableOOSCheck 1. MaxMemInQueues had a minor impact.
So I decided to use a firewall to limit connections.
...
So I set up this firewall rule:
/sbin/iptables -A INPUT -p tcp --syn ! --dport 22 -m connlimit --connlimit-above 100 -j DROP
You should replace 22 with the list of ports you use for SSH and other important connections, just in case.
And I installed iptables-persistent to save the rules. (It might be Debian-specific).
After I set up the firewall, the connections slowly dropped from 700 down to around 100. It only affects new connections, so it might take a while.
This worked well, but Tor was still using a lot of CPU with its OOS checks. And it was using 4GB of RAM, which is good, but not sustainable on my machine.
Today, I added these firewall rules to drop rapid connection attempts from the same IP address, even if there are under 100 connections:
iptables -I INPUT -p tcp --syn ! --dport 22 -m state --state NEW -m recent --set iptables -I INPUT -p tcp --syn ! --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 100 -j DROP
They drop connection attempts after there have been 100 attempts in a minute. So if there were 100 clients, that would be 1 connection per client per minute.
This reduced Tor's CPU usage and OOS warnings within a few minutes. I'm hoping RAM will go down over time.
I made the rules permanent using:
iptables-save > /etc/iptables/rules.v4
This might be Debian-specific.
T
-- Tim / teor
PGP C855 6CED 5D90 A0C5 29F6 4D43 450C BA7F 968F 094B ricochet:ekmygaiu4rzgsk6n ------------------------------------------------------------------------