How to deal with DDOS attacks?

Question

This post was not helpful: How to protect a hidden service against DDOS attack?

My onion keeps getting hit with denial of service attacks. Is there anything I can do to minimize the effects? POST attacks, so Layer 7?.

I found a few things on in the tor manual about rate-limiting but I'm not entirely sure if modifying these options will do any good.

http://expyuzz4wqqyqhjn.onion/docs/tor-manual.html.en

CountPrivateBandwidth 0|1

If this option is set, then Tor’s rate-limiting applies not only to remote connections, but also to connections to private addresses like 127.0.0.1 or 10.0.0.1. This is mostly useful for debugging rate-limiting. (Default: 0)

HiddenServiceMaxStreams N

The maximum number of simultaneous streams (connections) per rendezvous circuit. (Setting this to 0 will allow an unlimited number of simultaneous streams.) (Default: 0)

Any suggestions would be great. Thank you!

Answer 1

No tweaks you've mentioned in your question are necessery - leave them as it is: DOS point of attack here is not the webserver, but the tor instance itself: tor has a single-core crypto. So you need a 2+ core dedicated box for it with maximum core speed, a CPU overclock+overcool can be used too, for now. Even with my patches(I'll release them a bit later) it can be the point of failure too. You can use a multiple load-ballancing Tor instances for a single onion service, i.e. you have multiple ISP lines or a very fast one with 1 or 2 fast VPN's with different C-level static IP's for a multiple instances. If you need further info - you're welcome, just ask!