[tor-relays] Re: DDoS solution for Tor nodes - nftables variant implemented

On 13/09/2026 11:22, forest via tor-relays wrote:

chain tor_kill_established { type filter hook input priority filter - 1; policy accept;

ct state established tcp dport 9001 jump { ip saddr & $mask4_24 @tor_ddos4 drop ip6 saddr & $mask6_64 @tor_ddos6 drop } }

IMO this breaks the ruleset in a silent way - visible only after 24 hours of runtime. The origin ([1]) blocks for *at least* 1 day after the last malicious packet arrived (see [2] too) whereas the variant above blocks for only 1 day after the first packet arrived. [1] https://github.com/toralf/torutils#the-rule-set [2] https://github.com/toralf/torutils/blob/main/nftables-ingress.conf#L157 -- Toralf