This post was not helpful: How to protect a hidden service against DDOS attack?

My onion keeps getting hit with denial of service attacks. Is there anything I can do to minimize the effects? POST attacks, so Layer 7?.

I found a few things on in the tor manual about rate-limiting but I'm not entirely sure if modifying these options will do any good.


CountPrivateBandwidth 0|1

If this option is set, then Tor’s rate-limiting applies not only to remote connections, but also to connections to private addresses like or This is mostly useful for debugging rate-limiting. (Default: 0)

HiddenServiceMaxStreams N

The maximum number of simultaneous streams (connections) per rendezvous circuit. (Setting this to 0 will allow an unlimited number of simultaneous streams.) (Default: 0)

Any suggestions would be great. Thank you!

1 Answer 1


No tweaks you've mentioned in your question are necessery - leave them as it is: DOS point of attack here is not the webserver, but the tor instance itself: tor has a single-core crypto. So you need a 2+ core dedicated box for it with maximum core speed, a CPU overclock+overcool can be used too, for now. Even with my patches(I'll release them a bit later) it can be the point of failure too. You can use a multiple load-ballancing Tor instances for a single onion service, i.e. you have multiple ISP lines or a very fast one with 1 or 2 fast VPN's with different C-level static IP's for a multiple instances. If you need further info - you're welcome, just ask!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .