How to: Protect your node from DDOS attack!

Place for guides, manuals and other tips.
Post Reply
User avatar
Wiredancer
Seasoned Pleb
Posts: 49
Joined: 28 Aug 2021, 05:01
Location: New Zealand
URL: https://zbd.gg/wiredancer
Contact:

How to: Protect your node from DDOS attack!

Post by Wiredancer »

Recently a lot of lightning services has been taken down by DDOS as well as some node operators. I had issues with my channels suddenly starting to disconnect one by one usually ending up closed for a day or more, just to recover aster while and running fine. I have done quite a bit of debugging being furious for loosing uptime, but after a while I got to conclusion that it was a force from outside cutting my channels down. Can't confirm it was DDOS, but it feels like it may have been. Just wanted to share few tips I implemented as per advice of others. Note that I can't yet confirm how effective it is, will need some days to see whether the problem reoccurs.

DDoS Protection (as per Lightning Engineering Guide):

We suggest the following iptable rules for network flood protection:

Code: Select all

sudo iptables -N syn_flood
sudo iptables -A INPUT -p tcp --syn -j syn_flood
sudo iptables -A syn_flood -m limit --limit 1/s --limit-burst 3 -j RETURN
sudo iptables -A syn_flood -j DROP
sudo iptables -A INPUT -p icmp -m limit --limit 1/s --limit-burst 1 -j ACCEPT
sudo iptables -A INPUT -p icmp -m limit --limit 1/s --limit-burst 1 -j LOG --log-prefix PING-DROP:
sudo iptables -A INPUT -p icmp -j DROP
sudo iptables -A OUTPUT -p icmp -j ACCEPT
lnd.conf change (change from true to false)

Code: Select all

tor.streamisolation=false
Stream isolation basically opens isolated extra TOR circuit for each channel. If disabled one circuit will connect to all. Still need to confirm whether there are any negative implications of having only one circuit to be opened and connected to all, but on first glimpse this will get your channels connected much faster and possibly very quickly reconnects in case the circuit drops.

Will update as I learn more about DDOS mitigation.
Happy routing!
Did you find my post helpful?

Image

Why not send me few sats?

Copy the invoice here.
dov182
Newbie
Posts: 6
Joined: 24 Oct 2021, 20:11

Re: How to: Protect your node from DDOS attack!

Post by dov182 »

Interesting post.

Did this problem reoccured after such suggested changes were applied on your node?
Did you notice an improvement in security or did some other problems started to occur?
User avatar
Wiredancer
Seasoned Pleb
Posts: 49
Joined: 28 Aug 2021, 05:01
Location: New Zealand
URL: https://zbd.gg/wiredancer
Contact:

Re: How to: Protect your node from DDOS attack!

Post by Wiredancer »

Since the changes my node have much better uptime and channel stability, no more channel drops. Didn't notice any negative impacts.
Did you find my post helpful?

Image

Why not send me few sats?

Copy the invoice here.
Post Reply