New on LowEndTalk? Please Register and read our Community Rules.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
Comments
Here
funny way of doing it, maybe could also do just showing the bgp.tools scraper only that pic
Yea
my suggestions
The bgp.tools scraper periodically connects to the website and screenshots it. He just made his website show a full image but only to the scraper IP. And YES you should totally put in Lain that way!!
What was the cause of the move? I know there was a large-scale DDoS shortly before. Did they kick you out because a customer kept attracting DDoS attacks against their infra or something?
Looks good to me! Very good specs too for only $36/year. Does anyone have an affiliate link they'd like me to use?
Looks like his only issue was NVMe reliability. I don't have much of a concern about that, as long as it can beat the 80% uptime of my DeluxHost boxen. But good to know!
@aluy Use this one and I'll love you forever:
Original for reference:
@forest
They don't have an affiliate program right now.
If you order a VPS there, I can give you a couple of tips:
1) Manually limit the speed in the torrc config to the guaranteed speed in the tariff plan, since all tariffs are connected to a 10 Gbps link. The provider allows only short-term exceeding of the speed above the tariff plan, with frequent exceeding (I am sure that the TOR relay consumes a lot of traffic), the provider will manually cut your speed to the guaranteed one, so it is better to limit yourself than constantly abuse the hoster's link.
2) Check the website with the hoster's documentation, there is interesting information there. For example, it advises not to enable IPv6 support when ordering a VPS, but to do so after it is created. The documentation also specifies limits on TCP connections and other things.
3) If you will pay in cryptocurrency (I pay via Bitcoin Lightning), then I recommend using the method through "Payssion" (with a 7% commission). When I paid via "Payrexx" (4% commission) there were problems with depositing money in billing, and then the option of paying with cryptocurrency disappeared in this method altogether (apparently removed because of these problems).
4) External scanners will always show that all ports on the server are open, even if you have blocked everything in iptables/nftables. I believe this is due to the DDoS protection of the hoster, such as protection against TCP-SYN flood and the like.
Otherwise, I personally have not encountered any critical technical problems with the VPS during a couple of months of use.
I do daily backups through Restic+Rclone, so I have nothing to be afraid of.
This hoster started working only in August last year, it is not advertised here on LowEndTalk at all, so they don't have many clients.
At the beginning of the work, there may have been network problems (judging by the historical records of their Status page), some even lost data, as they say here, but now I think their work has stabilized.
Uh oh! Tor likes a lot of TCP connections:
https://docs.up-network.ch/documentation/vps/vps/network-restrictions-isolation-and-abuse-policy
So 50k connections total and 250 new connections per second? It might only be referring to new outbound ports though? Not sure, I'll ask them. Either way, that's not enough as low-bandwidth DDoS attacks can often increase the number far beyond 50k. If they can't or won't create an exception, then it may not be suitable for my needs.
How is that even possible? Does it monitor for an ACK and if it doesn't see any within a short timeframe, it spoofs an ACK?
@forest sounds like it will be harder challenge than you thought
Could be, but Swizerland is in the EU in a place with lots of cheap bandwidth, so I'm sure it'll be easier to find a good deal than if I were looking for those specs in APAC for the same price. So I remain optimistic.
That is just silly imo..
Are you running multiple Tor processes or is it something else? I've never seen that much except when under attack.
fug
Technically not part of EU and has very high labor cost. Hopefully you'd find new host
@forest Really, it's better to ask them, the limits here are not entirely clear.
TCP: 10204 (estab 10187, closed 1, orphaned 3, timewait 1)TCP: 55675 (estab 55128, closed 30, orphaned 236, timewait 30)DDoS attacks on TOR don't happen every day, in a normal period, I think 50,000 TCP connections are enough (the cheap tariff still only has 100Mbps bandwidth, a lot of users won't fit there).
In any case, you can manually set a global limit on the number of established TCP connections via iptables/nftables. In this case, at least the hoster will not suddenly limit your traffic.
The rest of the time, the relay will work fine.
Something like that, but the details of how it works are not written anywhere.
This came as a surprise to me: my firewall rules showed closed ports for my previous hoster, but for this one (with the same rules), all ports were open. But the previous hoster did not have DDoS protection.
If you look for another hoster with a server in Switzerland, then the characteristics will obviously be 2 times lower, and the price is 2 times higher.
All the offers I've seen have been priced at $6-10/month for a VPS in Switzerland. Clearly beyond your requirements.
You can order a VPS for a month there for the test and see what happens. And then change to an annual payment if you want to stay.
They happen a lot more than you might think, but they don't cripple the whole network. There's one going on right now, actually, targeting a subset of guards. It doesn't bring the relays down completely, but it causes the CPU to overload (each NTor handshake is expensive) so that it struggles to take more legitimate connections. Even at 2M connections, some relays can (just barely) continue functioning. But if it had to stop accepting connections at 50k, then it would always become unusable the moment a DDoS occurs even while it has plenty of CPU power remaining.
Currently I just limit each IP to have no more than 8 simultaneous connections to the relay, and add any IP that attempts more than 8 new connections in a 2 minute period or 32 new connections in a 1 hour period to a 24 hour blacklist. It works fairly well against most relay overload attacks, including the current one.
That'll interfere with port knocking and might also cause issues if it causes other relays to get stuck trying to connect to mine while mine is down for a reboot. I wonder what happens when it reboots and suddenly sees a remote IP sending an unexpected SYN/ACK. It'll probably reply with RST and kill the connection, whereas if the provider didn't spoof connections, the remote IP would still be re-sending SYNs every once in a while until the relay is up and acknowledges the attempt.
I have no idea how clients and other relays would handle a situation where the connections suddenly malfunction with spoofed acknowledgements when the relay reboots, rather than going unanswered. It might even get my relay blacklisted if it appears to be a DoS attempt (by tricking clients into holding open spoofed connections that won't actually speak the Tor protocol).
Yep, I will. If they can make an exception for me, I'll go with them. Otherwise I'll keep looking, even if I have to up my budget.
Tell me how it is after a week, I was planning to try them few months ago but seeing no reviews I dropped the idea.
I've emailed them to see if they can loosen their TCP connection restrictions, otherwise it might not be a good fit for me after all.
Yes multiple processes and there is an ongoing attack going on across the tor network.
Yep, it's coming from Contabo IPs. Consider using toalf's tor-ddos mitigation script if you use iptables. I'm deploying it across more of my fleet now and it's catching most of the attacks while leaving legitimate traffic untouched.
At its simplest, the current attack can be largely stopped by limiting simultaneous connections to the ORPort to 8 per IP.
This one?
Different one, this one: https://github.com/toralf/torutils
The Enkidu one is no longer maintained because the owner is dead or about to be.
You can't just write something so ominous and not specify if it's for a natural or not so natural reason
https://lists.torproject.org/mailman3/hyperkitty/list/[email protected]/thread/AEAV35JQUF5HVIZYCITIGVJOMXBEPV2F/
Oh thanks, need to deploy it as well.
This is what I'm currently experimenting with, as an nftables port of toralf's script (only allows port 22 for SSH and DDoS-protected Tor on 9001, but does not support persistence, auto-updating of hardcoded safe IPs, or multiple ORPorts):