> For the complete documentation index, see [llms.txt](https://docs.anyone.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.anyone.io/relay/troubleshooting/dos-mitigation.md).

# DoS mitigation tips

Anyone relays, especially exit and directory relays, are vulnerable to DoS attacks that can degrade performance or disrupt services. Anon provides built-in DoS mitigation options to protect relays from excessive circuit creation, connection flooding, or stream abuse. \
\
Below are some parameters that can be configured in your `anonrc` file for enhanced protection.

### :small\_blue\_diamond:Circuit Creation DoS Protection

Protects your relay from excessive circuit creation attempts.

```
DoSCircuitCreationEnabled 1
DoSCircuitCreationBurst 30
DoSCircuitCreationRate 3
DoSCircuitCreationMinConnections 3
DoSCircuitCreationDefenseTimePeriod 3600 seconds
DoSCircuitCreationDefenseType 2
```

{% hint style="info" %}
`DefenseType 2` will **refuse** circuit creation for the defined period if thresholds are exceeded.\
Helps prevent CPU exhaustion from malicious circuits.
{% endhint %}

### :small\_blue\_diamond:Connection Flooding Protection

Limits the rate and number of incoming connections to avoid exhaustion.

```
DoSConnectionEnabled 1
DoSConnectionDefenseType 2
DoSConnectionMaxConcurrentCount 50
DoSConnectionConnectRate 20
DoSConnectionConnectBurst 30
DoSConnectionConnectDefenseTimePeriod 24 hours
```

{% hint style="info" %}
`DefenseType 2` immediately closes excessive new connections.\
Recommended for middle and exit relays exposed to public traffic.
{% endhint %}

### :small\_blue\_diamond:Stream Abuse Protection

Protects against exit traffic generating too many streams per circuit.

```
DoSStreamCreationEnabled 1
DoSStreamCreationDefenseType 3
DoSStreamCreationRate 100
DoSStreamCreationBurst 200
```

{% hint style="info" %}
Only needed for **exit nodes**.
{% endhint %}

### :small\_blue\_diamond:Hidden Service DoS Protection

Protects your hidden service from introduction/rendezvous DoS attacks.

```
HiddenServiceEnableIntroDoSBurstPerSec 200
HiddenServiceEnableIntroDoSRatePerSec 25
HiddenServicePoWDefensesEnabled 1
HiddenServicePoWQueueRate 250
HiddenServicePoWQueueBurst 2500
CompiledProofOfWorkHash 1
```

{% hint style="info" %}
Includes:\
Proof-of-Work requirements\
Rate-limiting on intro points
{% endhint %}

### :small\_blue\_diamond:Disable Single-Hop Client Rendezvous

If you're running any type of **relay**, you can disallow single-hop client circuits to further reduce abuse, but it's completely optional.

```
DoSRefuseSingleHopClientRendezvous 1
```

***

### :small\_blue\_diamond:RTFM

For a better understanding of DoS mitigation strategies and configurations, please refer to the Anon Manual under 

[Manual](/sdk/native-sdk/manual.md#denial-of-service-mitigation-options)

The manual offers technical explanations and guidance to help you tailor your relay's defenses effectively.

{% content-ref url="/pages/u2rzmJTz21NEQcXIkJ4b" %}
[Manual](/sdk/native-sdk/manual.md)
{% endcontent-ref %}