[tor-relays] connlimit: better to use "DROP" or "REJECT --reject-with tcp-reset"?

[teor]

Hi,

Still having load trouble on your relay?
Try dropping rapid connection attempts.

> On 9 Jan 2018, at 16:32, teor <teor2345 at gmail.com> wrote:
> 
> I've tried various ways of limiting Tor's RAM and CPU.
> MaxAdvertisedBandwidth was effective, as was limiting Tor's file
> descriptors and DisableOOSCheck 1. MaxMemInQueues had a minor impact.
> 
> So I decided to use a firewall to limit connections.
> 
> ...
> 
> So I set up this firewall rule:
> 
> /sbin/iptables -A INPUT -p tcp --syn ! --dport 22 -m connlimit --connlimit-above 100 -j DROP
> 
> You should replace 22 with the list of ports you use for SSH and other
> important connections, just in case.
> 
> And I installed iptables-persistent to save the rules.
> (It might be Debian-specific).
> 
> After I set up the firewall, the connections slowly dropped from 700
> down to around 100. It only affects new connections, so it might take
> a while.

This worked well, but Tor was still using a lot of CPU with its OOS checks.
And it was using 4GB of RAM, which is good, but not sustainable on my machine.

Today, I added these firewall rules to drop rapid connection attempts
from the same IP address, even if there are under 100 connections:

iptables -I INPUT -p tcp --syn ! --dport 22 -m state --state NEW -m recent --set
iptables -I INPUT -p tcp --syn ! --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 100 -j DROP

They drop connection attempts after there have been 100 attempts in a minute.
So if there were 100 clients, that would be 1 connection per client per minute.

This reduced Tor's CPU usage and OOS warnings within a few minutes.
I'm hoping RAM will go down over time.

I made the rules permanent using:

iptables-save > /etc/iptables/rules.v4

This might be Debian-specific.

T

--
Tim / teor

PGP C855 6CED 5D90 A0C5 29F6 4D43 450C BA7F 968F 094B
ricochet:ekmygaiu4rzgsk6n
------------------------------------------------------------------------

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: Message signed with OpenPGP
URL: <http://lists.torproject.org/pipermail/tor-relays/attachments/20180110/8635227a/attachment.sig>