How can I limit the numbers of connections a Tor Relay is able to make? (iptables)

Question

My router doesn't seem to have enough RAM to hold all Tor connections. My internet's basically dead. Have to use mobile internet :( So I have to limit the connections that Tor makes or the server makes. I don't want to put down the bandwith I have since I want to support Tor as much as possible. Currently my server has 4000 connections on average since 3. January

I researched, tried what I can do but I failed. I had the idea to limit it using iptables, but that didn't seem to work. Here the link: https://serverfault.com/questions/539954/how-to-globally-limit-total-number-of-tcp-connections-with-iptables The only difference here is that it limits the connections for the whole server. I would be fine with it. It you add a --dport 35565 (OrPort) you would limit it for Tor only. Add it after --syn. I tried with and without OrPort. Tor does not use UDP so I don't have to limit the UDP connections.

Please help me as quick as you can since my parents are a bit angry about it and if I can't fix it I have to shut down the tor relay.

New: A limit like 15 works. But 2000 doesn't work. Why, iptables????

iptables -A INPUT -p tcp --syn --dport 25565 -m connlimit --connlimit-above 15 --connlimit-mask 0 -j DROP

works

iptables -A INPUT -p tcp --syn -m connlimit --connlimit-above 2000 --connlimit-mask 0 -j DROP

doesn't work

Using Ubuntu 21.04....

Answer 1

This script works, but may need a bit of improvement like a trap command. I made it by myself.

!/bin/bash

#iptables -A INPUT -p tcp --syn --dport 35565 -m connlimit --connlimit-above 15 --connlimit-mask 0 -j REJECT --reject-with tcp-reset

####### ALL VARIABLES #######
active=False            # Don't modify please.
iptables -F INPUT       # remove all iptables INPUT rules. You can comment it out if you have other rules active. We want to avoid existing limits.
max_connections=3900    # The total of connections you want to allow for this server.
ORPort=35565            # The port your Tor Relay is using.
snore=60                # Time how long to wait, until it checks again. In seconds but you can use following expressions: s, m, h, d, ... (sleep command, example: 1h).
####### END VARIABLES #######

######################## DONT MODIFY THE CODE BELOW UNLESS YOU KNOW WHAT YOU'RE DOING!
while (true)
do
    n_connections=`netstat -n --tcp|wc -l`
    if [ "$n_connections" -ge "$max_connections" ]
    then
        if [ "$active" == "False" ]
        then
            iptables -A INPUT -p tcp --syn --dport "$ORPort" -m connlimit --connlimit-above 15 --connlimit-mask 0 -j REJECT --reject-with tcp-reset
            active=True                                # Don't allow more than 15 connections. Existing connections will still work.
            echo "Tor Limit: Limit activated, your server has $n_connections"
                                                       # I don't recommend to block output connections because if you're a guard you will change output connections often
        fi
    else
        if [ $active ]
        then
            iptables -F INPUT
            active=False
            echo "Tor Limit: Limit deactivated"
        fi
    fi
    
    sleep "$snore"
done