Hi Zwiebelrouter,
interestingly, I saw the same Contabo Adresses, and as you said, they were tor unrelated. However, I thought this might be a “Client” connecting to me, so then it would be a legit connection not coming from a relay. In the same time, I experienced a lot of portscans, I checked my IPS Alarms and two of them where Contabo Adresses. The first scan came from a French Site, the second from Germany. But this might be due to the simple fact, that Contabo has only “EU” as Region, so its kinda random where the rented VPS is started. But maybe there is a specific “enemy” that is using Contabo VPS to try and overwhelm espescially cost effective VPS-Relays, as in their nature there is not much resource headroom for such garbage. I checked the states 5 Minutes ago, and it even got worse, with 225k Open TCP Connections, however my maximum is beyond 2M States. The known attack behind this behavior is state table exhaustion, where your Firewall gets overwhelmed with useless TCP-Connections till there is no state left for legit traffic. I use syncookies for this, meaning if the state table exceeds my threshold, syn-cookies will be used instead of the state table, thus, an overflow should be prevented. Maybe this could be an effective option to protect your relay, it should be possible to implement without additional software on Free-BSD based relays. Or you could increase the size of the state table in exchange for CPU-Time and RAM. Pretty annoying. Thanks for your feedback and best regards, Joker P.S. I just checked a bit further and from the Contabo Subnets, e.g. 13.140.189.0 – 13.140.191.254 alone, more than 100k TCP Connections, but they come from various IPs, I picked four random IPs and none of them were listed as relay. And they had, as you said, about 200 – 250 TCP Connections each, as in your case. Very suspicious.. Von: zwiebelrouter via tor-relays [mailto:[email protected]] Gesendet: Dienstag, 7. Juli 2026 23:20 An: support and questions about running Tor relays (exit, non-exit, bridge) Cc: ProSecureRelays; zwiebelrouter Betreff: [tor-relays] Re: Abnormal Firewall-States since 0.4.9.10 Hi all, I am observing the same behavior with one of my FreeBSD relays. All hover around 15k active TCP states according to the pf firewall, except one, which hovers around 90k TCP states. All run tor version 0.4.9.11. The affected relay's fingerprint is the following: CE0D31663C7CE954B1944B6D65449963F12BDF78 Other things I have observed: At 8 am UTC the CPU usage of the affected relay spiked sharply, while traffic simultaneously dropped significantly. At around 10:50 am UTC, outgoing Tor traffic dropped to around 5%, while incoming traffic sharply rised to 135% of normal network traffic. The relay was completely unresponsive up until around 4:22 pm UTC, when traffic returned to normal, except for the 6x increase in TCP states. I suppose my relay was hit by some kind of DoS attack? In the syslog I can see pf firewall entries about hitting max states, which are at 100.000 concurrent states, which is abnormal. Another thing I've seen is that some other Tor relays have between 10 to 200 TCP states, even though they only have 1-8 Tor sessions running from their source IP addresses. Strange, but unrelated: - There hundreds of IPs from the same /24 networks accessing my Tor relays, all hosted on Contabo, which don't seem to be Tor Relays, but also don't look look like Tor bridges either (?). - All of them account to around 6k TCP states, all wit around 50. I don't know what I should to with this information, but maybe someone finds this interesting. Cheers, ZR On Saturday, July 4th, 2026 at 11:20, ProSecureRelays via tor-relays <[email protected]> wrote: Hi there, I want to report abnormal Firewall States since the update. Since a week or two, (I believe with 0.4.9.10) tor started to excessively use Firewall-States, far beyond what I observed beforehand. In normal operation, I observed about 20k – 45k Firewall States for the relay. Yesterday, before I installed the update, I had 190k Firewall States, related to Tor Relay Traffic. The days before it cycled from 120 – 145k States. Also far more than normal. Today, I see excessive Errors (> 20 Errors/Sek) in my Firewall, relating to use of invalid Firewall States (pf: BAD State..) – all are Tor Related Connections. It would be nice if anyone could have a look, if your connections increased also that much. I also wonder if this might be a type of attack? Regardless of the odd connections, the relay is running well, no CPU peaks and normal memory usage (602MB). Best regards and have a nice weekend! Joker
_______________________________________________ tor-relays mailing list -- [email protected] To unsubscribe send an email to [email protected]
