I want to run an open Tor router.
My exit policy will be similar to ReducedExitPolicy.
But I also want to make it hard for the tor network to abuse my resources.
Cases I want to prevent clients from doing via Tor:
- Hammering one site with very many packets.
- Aggresive netscans of whole IP blocks
Cases I do NOT want to prevent clients from doing via Tor:
- uploading a few hudreds of image files to the cloud
- seeding a torrent
My question is, can this be done at all, and how?
My first thought was some firewall (Linux/iptables or *BSD/ipfw/pf) - but this will probably be useless due to inherent properties of the Onion router.
Is there any ongoing torproject team development on this topic?
I also ask for general hints on securing Tor exit nodes.
Update (Sep 2012)
From helpful answers and some other research I think this can not be done.
The best you can do to stop people from abusing exit node to contribute in DDOS, is to detect very frequent packets directed to one IP.
The "very frequent" threshold depends on total node bandwidth... If it is wrong, there will be false positives, blocking legitimate traffic of realtime TCP apps and traffic sourced from very many clients to one destination.
Update (Dec 2014)
My predictions were obviously true - I had several network abuse complaints from my internet provider.
To avoid service shutdown I had to employ following set of
iptables rules (
ONEW is a chain for outgoing TCP SYN (aka NEW) packets :
I'm not sure it will suffice but here it is:
-A ONEW -o lo -j ACCEPT -A ONEW -p udp --dport 53 -m limit --limit 2/sec --limit-burst 5 -j ACCEPT -A ONEW -m hashlimit --hashlimit-upto 1/second --hashlimit-mode dstip --hashlimit-dstmask 24 --hashlimit-name ONEW -j ACCEPT -A ONEW -m limit --limit 1/sec -j LOG --log-prefix "REJECTED: " -A ONEW -j REJECT --reject-with icmp-admin-prohibited