Skip to main content

How to protect a tunnel from floods with connection limits

Since app version 1.3.0

Flood protection is on for every plan by itself. To tune it for your service, open the tunnel, its "Security" tab, the "Limits" section: that is where you set how many connections one address may hold and when to ban it.

Connection limits​

  1. Under "Tunnels", open the tunnel and go to the "Security" tab.
  2. In the "Tunnel protection" card, pick the "Limits" section.
  3. Set the values you need:
    • "Connections from one address" for TCP and HTTPS;
    • "UDP flows from one address" for UDP;
    • "New connections a minute before a ban" and "Ban for, minutes": when and for how long to ban an address that connects too often.
  4. Turn "Ban an address that connects too often" on or off.
  5. Click "Save".

The value "As set on the server" means the node's own setting applies. "Restore defaults" returns every field to its default.

Check who the tunnel turned away​

The "Refusals" section shows who the tunnel turned away while the app is open, and why: for example, "Blocked by the lists" or "Banned for a while: too many new connections". The "Deny" button next to an address puts it on the deny list. UDP addresses don't get it: "A UDP address can be forged, so denying it is not worth it".

Since app version 1.3.0

On the "Overview" tab, the "Security" card shows the latest visitors to the address. The icon next to an address (tooltip "Ban …") bans it; the nodes stop letting it in within 20 seconds.