feat(awg): per-peer connection flood warnings (P2P/torrent detection) - #100
Open
leonidorlov-hash wants to merge 4 commits into
Open
feat(awg): per-peer connection flood warnings (P2P/torrent detection)#100leonidorlov-hash wants to merge 4 commits into
leonidorlov-hash wants to merge 4 commits into
Conversation
- Count conntrack entries per peer IP from /proc/net/nf_conntrack (no extra packages on the host), matching against the instance subnet - Record a warning when a peer exceeds 600 simultaneous connections, at most one per hour per peer, keeping the last 5 events; persisted in conn_warnings.json inside the container data dir (volume-backed) - Render warnings under the client meta row (.conn-warnings/.conn-warning, no inline styles), localized via new conn_warning_text key (en/ru/fr/fa/zh) - Show peer internal IP next to the client name (.client-ip)
NAT for the VPN subnet happens in the container's network namespace, so the host /proc/net/nf_conntrack only sees the container's own IP and per-peer counts were always zero.
The torrent-detection warning block under a peer now has a 🗑 button that
wipes the recorded warning history for that peer (conn_warnings.json is
keyed by peer IP; backend resolves the IP from clientsTable).
Adds POST /api/servers/{id}/connections/clear_warnings and
clear_warnings / warnings_cleared translation keys.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Что добавляет
Индикация пиров с аномально большим числом одновременных соединений — типичный признак торрентов/P2P, которые забивают conntrack и полосу сервера.
Под карточкой пира появляются предупреждения вида:
(текст локализован, язык берётся из настроек панели)
Как работает
/proc/net/nf_conntrack— на хосте виден только IP контейнера, поэтому читаем изнутри). Дополнительных пакетов на хосте не требуется.conn_warnings.jsonв data-каталоге контейнера (volume-backed, переживает рестарты).Что НЕ входит
Никаких автоматических блокировок — только индикация, админ сам решает что делать с нарушителем. (Авто-бан в планах.)
Замечания