-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hello. So far, this is what I have for IPv4 (without any persistence features, so the sets disappear on restart), but I have nothing yet for IPv6 because I'm trying to figure out a better way to apply blocks with more fine-grained comparisons than "/64 for Hetzner etc, /80 for IONOS etc". flush ruleset table inet filter { set tor_ddos { type ipv4_addr flags timeout timeout 24h } set tor_connlimit { type ipv4_addr } define tor_trusted = { # snowflake servers 141.212.118.18, 193.187.88.42, 193.187.88.43, 193.187.88.44, 193.187.88.45, 193.187.88.46, # directory authorities 45.66.35.11, 66.111.2.131, 128.31.0.39, 131.188.40.189, 171.25.193.9, 193.23.244.244, 199.58.81.140, 204.13.164.118, 216.218.219.41, 217.196.147.77 } chain tor_input { ip saddr $tor_trusted accept ip saddr @tor_ddos log prefix "ddos-block " drop add @tor_connlimit { ip saddr ct count over 8 } log prefix "excessive-connections " drop meter tor-ddos-fast { ip saddr timeout 2m limit rate over 8/minute burst 8 packets } add @tor_ddos { ip saddr } log prefix "add-ddos-fast " drop meter tor-ddos-slow { ip saddr timeout 1h limit rate over 16/hour burst 16 packets } add @tor_ddos { ip saddr } log prefix "add-ddos-slow " drop accept } chain input { type filter hook input priority filter; policy drop; iif lo accept ct state { established, related } accept ct state new jump { tcp dport 9001 tcp flags syn jump tor_input tcp dport 22 accept } icmp type echo-request limit rate 25/second accept } chain output { type filter hook output priority filter; policy accept; } chain forward { type filter hook forward priority filter; policy drop; } } -----BEGIN PGP SIGNATURE----- iHUEARYKAB0WIQQtr8ZXhq/o01Qf/pow+TRLM+X4xgUCal2ReQAKCRAw+TRLM+X4 xqQTAQCvT5L3BmfIkBUfP0wM28sTgUHKnPu0ixdElgOgOpSsZgEAwzOYh+CRdW9C 1lOzZZiu/PbBKoxB+NuPioKEXq30Egw= =G2JJ -----END PGP SIGNATURE-----