1

This post was not helpful: How to protect a hidden service against DDOS attack?

My onion keeps getting hit with denial of service attacks. Is there anything I can do to minimize the effects? POST attacks, so Layer 7?.

I found a few things on in the tor manual about rate-limiting but I'm not entirely sure if modifying these options will do any good.

http://expyuzz4wqqyqhjn.onion/docs/tor-manual.html.en

CountPrivateBandwidth 0|1

If this option is set, then Tor’s rate-limiting applies not only to remote connections, but also to connections to private addresses like 127.0.0.1 or 10.0.0.1. This is mostly useful for debugging rate-limiting. (Default: 0)

HiddenServiceMaxStreams N

The maximum number of simultaneous streams (connections) per rendezvous circuit. (Setting this to 0 will allow an unlimited number of simultaneous streams.) (Default: 0)

Any suggestions would be great. Thank you!

1

No tweaks you've mentioned in your question are necessery - leave them as it is: DOS point of attack here is not the webserver, but the tor instance itself: tor has a single-core crypto. So you need a 2+ core dedicated box for it with maximum core speed, a CPU overclock+overcool can be used too, for now. Even with my patches(I'll release them a bit later) it can be the point of failure too. You can use a multiple load-ballancing Tor instances for a single onion service, i.e. you have multiple ISP lines or a very fast one with 1 or 2 fast VPN's with different C-level static IP's for a multiple instances. If you need further info - you're welcome, just ask!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.