From 3efd9a089cc6b924d9bc917d3d8145f7c01265ad Mon Sep 17 00:00:00 2001 From: Bitflash-sh Date: Fri, 24 Jul 2026 12:13:30 -0300 Subject: Multi-relay rendezvous with failover + relay rate-limiting Seed list of 3 geographically-spread relays (Sao Paulo, New Jersey, Almaty); nodes register at the first reachable one and fail over if it is attacked or goes down, so no single relay IP is a point of failure. Relay installer now applies iptables connection rate-limits to soak up single-source floods. --- relay/install-bitflash-relay.sh | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) (limited to 'relay') diff --git a/relay/install-bitflash-relay.sh b/relay/install-bitflash-relay.sh index 77a46b2..fd901ac 100644 --- a/relay/install-bitflash-relay.sh +++ b/relay/install-bitflash-relay.sh @@ -295,6 +295,25 @@ echo ">> building bitflashd" g++ -std=gnu++14 -O2 -pthread bitflashd.cpp btfrv.cpp -o bitflashd echo ">> build OK: $DIR/bitflashd" +# Basic anti-flood firewall rules (idempotent). These soak up single-source +# connection floods; volumetric DDoS still needs provider-level protection. +# Limits are generous so many users behind one CGNAT public IP aren't blocked. +if command -v iptables >/dev/null 2>&1; then + echo ">> applying connection rate-limit on port $PORT" + # Cap concurrent connections per source IP (stops one IP hogging thousands) + iptables -C INPUT -p tcp --dport "$PORT" -m connlimit --connlimit-above 200 --connlimit-mask 32 -j REJECT --reject-with tcp-reset 2>/dev/null || \ + iptables -A INPUT -p tcp --dport "$PORT" -m connlimit --connlimit-above 200 --connlimit-mask 32 -j REJECT --reject-with tcp-reset + # Cap NEW-connection rate per source IP (stops connection floods) + iptables -C INPUT -p tcp --dport "$PORT" -m conntrack --ctstate NEW -m hashlimit \ + --hashlimit-name btfrelay --hashlimit-mode srcip --hashlimit-above 60/min --hashlimit-burst 100 -j DROP 2>/dev/null || \ + iptables -A INPUT -p tcp --dport "$PORT" -m conntrack --ctstate NEW -m hashlimit \ + --hashlimit-name btfrelay --hashlimit-mode srcip --hashlimit-above 60/min --hashlimit-burst 100 -j DROP + # Persist across reboots if the tooling is present + command -v netfilter-persistent >/dev/null 2>&1 && netfilter-persistent save >/dev/null 2>&1 || true +else + echo ">> iptables not found; skipping rate-limit (host on a provider with anti-DDoS)" +fi + # systemd service so it survives reboots (skipped if systemd is absent) if command -v systemctl >/dev/null 2>&1 && [ -d /etc/systemd/system ]; then cat > /etc/systemd/system/bitflashd.service <