Skip to content

Latest commit

 

History

History
62 lines (44 loc) · 2.83 KB

setup-iptables.md

File metadata and controls

62 lines (44 loc) · 2.83 KB

Setup iptables rules (recommended)

In order to prevent the indy-node process from reaching of open file descriptors limit caused by clients connections it is strongly recommended to add iptables rule that limits the number of simultaneous clients connections for client port.

Also iptables can be used to deal with various DoS attacks (e.g. syn flood) but rules' parameters are not estimated yet.

NOTE: you should be a root to operate with iptables.

Setting up clients connections limit

Using raw iptables command or iptables front-end

In case of deb installation the indy-node environment file /etc/indy/indy.env is created by init_indy_node script. This environment file contains client port (NODE_CLIENT_PORT) and recommended clients connections limit (CLIENT_CONNECTIONS_LIMIT). This parameters can be used to add the iptables rule for chain INPUT:

# iptables -I INPUT -p tcp --syn --dport 9702 -m connlimit --connlimit-above 15360 --connlimit-mask 0 -j REJECT --reject-with tcp-reset

Some key options:

  • --dport - a port for which limit is set
  • --connlimit-above - connections limit, exceeding new connections will be rejected using TCP reset
  • --connlimit-mask - group hosts using the prefix length, 0 means "all subnets"

Corresponding fields should be set in case of some iptables front-end usage.

Using indy scripts

For ease of use and for people that are not familiar with iptables we've added two scripts:

  • setup_iptables: adds a rule to iptables to limit the number of simultaneous clients connections for specified port;
  • setup_indy_node_iptables: a wrapper for setup_iptables script which gets client port and recommended connections limit from indy-node environment file that is created by init_indy_node script.

Links to these scripts:

NOTE: for now the iptables chain for which the rule is added is not parameterized, the rule is always added for INPUT chain, we can parameterize it in future if needed.

For deb installation

To setup the limit of the number of simultaneous clients connections it is enough to run the following script without parameters

# setup_indy_node_iptables

This script gets client port and recommended connections limit from the indy-node environment file.

NOTE: this script should be called after init_indy_node script.

For pip installation

The setup_indy_node_iptables script can not be used in case of pip installation as indy-node environment file does not exist, use the setup_iptables script instead (9702 is a client port, 15360 is recommended limit for now)

# setup_iptables 9702 15360

In fact, the setup_indy_node_iptables script is just a wrapper for the setup_iptables script.