0

My router doesn't seem to have enough RAM to hold all Tor connections. My internet's basically dead. Have to use mobile internet :( So I have to limit the connections that Tor makes or the server makes. I don't want to put down the bandwith I have since I want to support Tor as much as possible. Currently my server has 4000 connections on average since 3. January

I researched, tried what I can do but I failed. I had the idea to limit it using iptables, but that didn't seem to work. Here the link: https://serverfault.com/questions/539954/how-to-globally-limit-total-number-of-tcp-connections-with-iptables The only difference here is that it limits the connections for the whole server. I would be fine with it. It you add a --dport 35565 (OrPort) you would limit it for Tor only. Add it after --syn. I tried with and without OrPort. Tor does not use UDP so I don't have to limit the UDP connections.

Please help me as quick as you can since my parents are a bit angry about it and if I can't fix it I have to shut down the tor relay.

New: A limit like 15 works. But 2000 doesn't work. Why, iptables????

iptables -A INPUT -p tcp --syn --dport 25565 -m connlimit --connlimit-above 15 --connlimit-mask 0 -j DROP

works

iptables -A INPUT -p tcp --syn -m connlimit --connlimit-above 2000 --connlimit-mask 0 -j DROP

doesn't work

Using Ubuntu 21.04....

3
  • I tried it without ufw enabled. UFW can't be a cause why it doesn't work.
    – france1
    Jan 5 at 13:57
  • Maybe the connections (2000 for example as max limit) are too high for iptables? It might've work before, I tried it with 15.
    – france1
    Jan 5 at 17:41
  • confirmed it works with 15
    – france1
    Jan 5 at 18:03
0

This script works, but may need a bit of improvement like a trap command. I made it by myself.

!/bin/bash

#iptables -A INPUT -p tcp --syn --dport 35565 -m connlimit --connlimit-above 15 --connlimit-mask 0 -j REJECT --reject-with tcp-reset

####### ALL VARIABLES #######
active=False            # Don't modify please.
iptables -F INPUT       # remove all iptables INPUT rules. You can comment it out if you have other rules active. We want to avoid existing limits.
max_connections=3900    # The total of connections you want to allow for this server.
ORPort=35565            # The port your Tor Relay is using.
snore=60                # Time how long to wait, until it checks again. In seconds but you can use following expressions: s, m, h, d, ... (sleep command, example: 1h).
####### END VARIABLES #######

######################## DONT MODIFY THE CODE BELOW UNLESS YOU KNOW WHAT YOU'RE DOING!
while (true)
do
    n_connections=`netstat -n --tcp|wc -l`
    if [ "$n_connections" -ge "$max_connections" ]
    then
        if [ "$active" == "False" ]
        then
            iptables -A INPUT -p tcp --syn --dport "$ORPort" -m connlimit --connlimit-above 15 --connlimit-mask 0 -j REJECT --reject-with tcp-reset
            active=True                                # Don't allow more than 15 connections. Existing connections will still work.
            echo "Tor Limit: Limit activated, your server has $n_connections"
                                                       # I don't recommend to block output connections because if you're a guard you will change output connections often
        fi
    else
        if [ $active ]
        then
            iptables -F INPUT
            active=False
            echo "Tor Limit: Limit deactivated"
        fi
    fi
    
    sleep "$snore"
done
1
  • I had to lower the max_connections variable. It was still to high. It's now 3500.
    – france1
    Jan 16 at 8:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.