From 6856b82bdcd61ea25cac8bc64a9114d908e6ea9e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Asbj=C3=B8rn=20Sloth=20T=C3=B8nnesen?= <asbjorn@labitat.dk>
Date: Mon, 6 Sep 2021 18:13:20 +0000
Subject: space_server: add dedicated VLAN for Tor exit nodes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Move the Tor exit nodes to their own VLAN, and
their own address space.
Background for move
-------------------
For the first Tor exit node, we where able to
create inet6num object 2a01:4262:1ab:20::71/128.
So we could assign a specific Tor abuse contact.
When we added the second node it was no longer
possible to create /128 inet6num objects, but
only up to /64. We therefore need to move our
Tor exit nodes to a dedicated address space.
Connection tracking
-------------------
Connection tracking is quite expensive, so
it's better to only do it for Tor traffic,
when we actually need it, which is only when
internal clients need to access the servers.
In the future conntrack could also be disabled
for labicolo in general.
Current stats
~~~~~~~~~~~~~
[root@space ~]# grep -v '185\.38\.175\.7[12] ' /proc/net/nf_conntrack |
grep -v '2a01:4262:01ab:0020:0000:0000:0000:007[12]' | wc -l
4071
[root@space ~]# wc -l /proc/net/nf_conntrack
39138 /proc/net/nf_conntrack
Currently 4071 out of 39138 connections are not Tor related.
Also reading /proc/net/nf_conntrack is quite slow atm.:
[root@space ~]# time cat /proc/net/nf_conntrack > /dev/null
real 0m35.097s
user 0m0.010s
sys 0m28.114s
Signed-off-by: Asbjørn Sloth Tønnesen <asbjorn@labitat.dk>
---
documentation/addressplan.txt | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
(limited to 'documentation')
diff --git a/documentation/addressplan.txt b/documentation/addressplan.txt
index ade8805..b5e8f94 100644
--- a/documentation/addressplan.txt
+++ b/documentation/addressplan.txt
@@ -6,11 +6,12 @@
* 185.38.175.065 - space.labitat.dk, labicolo gateway
* 185.38.175.069 - spacebrain.labitat.dk
* 185.38.175.070 - spacewand.labitat.dk
- * 185.38.175.071 - reserved for tor exit node
* 185.38.175.075 - Asbjorn
* 185.38.175.076 - Deni
* 185.38.175.077 - KTJ
* 185.38.175.078 - Graffen
+ ***** 185.38.175.128/28 - Tor exit nodes
+ * 185.38.175.129 - space.labitat.dk - gateway
********************* 2a01:4262:1ab:0000::/48 - allocated and announced
******************** 2a01:4262:1ab:0xxx::/52 - labitat internal use
@@ -38,6 +39,8 @@
******************* 2a01:4262:1ab:11xx::/56 - 16x /60 delegations
****************** 2a01:4262:1ab:110x::/60 - Asbjorn
****************** 2a01:4262:1ab:111x::/60 - Esmil
+ ******************** 2a01:4262:1ab:fxxx::/52 - untrusted address space
+ ***************** 2a01:4262:1ab:ffff::/64 - Tor exit nodes
Linknets:
--
cgit v1.2.1