For anyone running a Cisco ASA between
their 'tor' relay and the Internet,
some potentially useful info:
The default ASA connection timeout is
short and often results in 'telnet'
sessions through VPN tunnels getting
whacked. So one might add
timeout conn 48:00:00
to a config to mitigate that issue.
However a busy 'tor' relay instance
will rapidly accumulate large numbers
of dead connection table entries due
to loss of FIN packets from flaky
corners of Internet.
I'm not 100% sure about this, but it
seems these dead connection table entries
can impair the formation of new connections,
not to mention the obvious potential
for excessive memory consumption on
the ASA.
The solution is:
access-list tor-class extended permit tcp any host X.X.X.X
access-list tor-class extended permit tcp host X.X.X.X any
where X.X.X.X is the 'inside' server running 'tor'
class-map tor
match access-list tor-class
policy-map outside
class tor
set connection timeout idle 0:06:00
As 'tor' sockets have a default
KeepalivePeriod 300
any connection with an idle time
of more than five minutes is a dead
duck and can safely be removed. Checked this
out carefully. The comment above was inspired
by a seeming performance boost and increase
in connections observed after the change
was made, not by direct traffic analysis.
Could be coincidental.
The way to verify it's working is with the
show conn addr X.X.X.X long
command, which includes the idle timeout
associated with each connection.
If one has other services running on the
same box as 'tor', it might be necessary
to adjust the 'access-list' to take them
into account.
_______________________________________________
tor-relays mailing list
tor-relays@lists.torproject.org
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays
