How can I best protect a Monero service (clearnet) from DDoS attacks while at the same time protecting the privacy of users? The Monero service will require that I provide users with the IP address of my full node, so they are able to connect to it.

While of the following measures are generally seen as less intrusive to the privacy of users:

  1. Cloudfare with capcha
  2. Email address confirmation for upon registration and subsequent login with username and password
  3. Blacklisting of IP addresses that have been involved in previous DDoS attacks

closed as unclear what you're asking by seek adventure, Smart Kid, Sam, Game Changer, John Aug 8 '16 at 15:46


  • 4
    The first two components seem like a general server-admin question suited for stack overflow or something like that. The third component might have some relevance to Monero. The question might be improved by expanding on the second point - what current DDOS prevention techniques reduce privacy of users? Requiring logins? – Ginger Ale Aug 1 '16 at 2:13
  • 3
    +1 Ginger Ale. Although by the time you require an email/login, you're already DoSed, really. – user36303 Aug 1 '16 at 22:23

All three of the options you mentioned negatively impact user privacy.

  1. Cloudfare is often unfriendly to Tor users.
  2. Logic requirements mean the collection of data from users
  3. IP blocking harms innocent users (whose VPN ip address or Tor exit node usage may be flagged as abusive due to no fault of their own).

One thing you could try is to require none of the above as your baseline and only activate Cloudfare selectively at times of unusually high usage.
