Advanced DDoS Protection for Tor Hidden Services
If Fortify helps protect your service, consider supporting development:
Monero (XMR):
8BWceRPePNGBJditiULcsHao4jShvuQeQ9tisu7sU2efHnMqJqeQdcnXM9h3qYsGUx53jP5mV7zpdWGgWFCKhWzPDtysEu1
What does "Security Audit Passed" mean?
Our Security Audit workflow runs 6 independent security checks:
| Check | Tool | What It Validates |
|---|---|---|
| Vulnerability Scan | cargo-audit |
Checks all dependencies against RustSec Advisory Database for known CVEs |
| License Compliance | cargo-deny |
Ensures all dependencies use approved licenses (MIT, Apache-2.0, BSD) |
| SAST Analysis | Semgrep |
Static analysis for security anti-patterns, injection risks, unsafe patterns |
| Unsafe Code Audit | cargo-geiger |
Reports all unsafe blocks in codebase and dependencies |
| Secrets Detection | Gitleaks |
Scans for accidentally committed API keys, tokens, credentials |
| Supply Chain | cargo-vet |
Verifies dependency integrity and trusted sources |
Runs daily and on every push to main. View workflow →
What does "CI Passed" mean?
| Check | Description |
|---|---|
| Build | Compiles on stable Rust with all features |
| Tests | 131+ unit and integration tests pass |
| Clippy | Zero warnings from Rust linter |
| Format | Code follows rustfmt standards |
What does "Tor Alignment Passed" mean?
Ensures Fortify is fully compatible with Tor Browser's privacy requirements:
| Check | What It Validates |
|---|---|
| No JavaScript | HTML contains no <script> tags (Tor Browser disables JS by default) |
| No External URLs | No CDN, Google Fonts, or external resource loading (prevents deanonymization) |
| No Tracking | No tracking pixels, analytics, or inline event handlers |
| Privacy Patterns | Flags IP extraction and User-Agent logging for review |
| Tor Headers | Reports on Onion-Location and security header implementation |
Runs on every push/PR. View workflow →
Fortify is a sophisticated multi-layered defense system that protects Tor hidden services from DDoS attacks while maintaining access for legitimate users. Built in Rust for performance and security, Fortify acts as a proxy shield between attackers and your real hidden service.
Production-Ready Core Protection ✅
Battle-tested DDoS defense for Tor hidden services. Blocks attack traffic while maintaining access for legitimate users.
Current Capabilities:
- ✅ Per-circuit rate limiting (prevents IP-based blocking on Tor)
- ✅ Single-use verification tokens (prevents CAPTCHA farming)
- ✅ Trust tier system with behavioral analysis
- ✅ Session protection with User-Agent binding
- ✅ 7 CAPTCHA types (JavaScript-free, Tor-compatible)
- ✅ Automatic quota clearing after verification
In Development:
- 🔄 TUI deployment wizard (40% complete)
- ⏳ Mirror management automation (Phase 4)
- ⏳ Auto-scaling system (Phase 4)
- ⏳ Cluster support (Phase 5)
# 1. Update system and install build dependencies
sudo apt update && sudo apt upgrade -y
sudo apt install -y git build-essential pkg-config libssl-dev
# 2. Clone the repository
git clone https://github.com/Nespartious/Fortify.git
cd Fortify/fortify
# 3. Install Rust
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
source $HOME/.cargo/env
# 4. Build the project
cargo build --release
# 5. Run the TUI
./target/release/fortifyFortify uses an interactive TUI (Terminal User Interface) for deployment and management.
# Launch the Fortify TUI
./target/release/fortifyThe TUI provides:
- Deployment Wizard - Step-by-step setup for new deployments
- Live Status Monitoring - Real-time component health and metrics
- Configuration Management - Hot-reload settings without restart
- Log Streaming - Multi-component log aggregation
- Mirror Management - View and manage .onion addresses
Navigation:
- Arrow keys to navigate
- Enter to select
- Tab to switch panels
- Esc to go back
- 'q' to quit
For automated/headless server deployments without interactive TUI.
Fortify includes a comprehensive deployment script that configures everything from a single file. Perfect for:
- Automated server provisioning
- Infrastructure-as-code setups
- Headless server environments
- Reproducible deployments
# 1. Clone the repository
git clone https://github.com/Nespartious/Fortify.git
cd Fortify
# 2. Edit the deployment script configuration
# Open deploy.sh and modify the settings at the top of the file.
# Each setting has comments explaining what it does.
nano deploy.sh
# 3. Review your configuration
# Make sure BACKEND_ADDRESS points to your real service
# Adjust CAPTCHA, mirror, and security settings as needed
# 4. Run the deployment (requires root)
sudo ./deploy.shThe script will:
- ✅ Install all system dependencies (Tor, Rust, build tools)
- ✅ Apply OS hardening (sysctl, file limits)
- ✅ Build Fortify from source
- ✅ Generate configuration from your settings
- ✅ Install and enable systemd services
- ✅ Start all components
Key Configuration Sections in deploy.sh:
| Section | Description |
|---|---|
| Backend Settings | Your protected service address and branding |
| Mirror Settings | Number of mirrors and rotation behavior |
| Vanity Settings | Custom .onion address prefixes |
| CAPTCHA Settings | Pool size, difficulty, timeouts |
| Rate Limiting | Request limits and ban thresholds |
| Vanguards | Tor circuit protection settings |
| Auto-Scaling | Dynamic resource allocation |
For development/debugging, individual components can be run:
# Controller (resource monitoring)
./target/release/fortify-controller
# Orchestrator (mirror management)
SECRET_KEY="your-secret" ./target/release/fortify-orchestrator
# Gate (CAPTCHA verification)
SECRET_KEY="your-secret" ./target/release/fortify-gate
# HTTP Proxy (main traffic handler)
SECRET_KEY="your-secret" ./target/release/fortify-http
# Nodes (backend services)
NODE_MODE="healthy" ./target/release/fortify-node
NODE_MODE="threat" ./target/release/fortify-nodeRequirements:
- Rust: 1.88 or higher (MSRV)
- Tor: Latest stable version
- OS: Linux (tested on Ubuntu 22.04/24.04)
- CPU: 4 cores recommended (2 cores minimum)
- RAM: 4GB minimum (includes ~1GB OS overhead for Ubuntu Server)
- Disk: 2GB for binaries + logs + OS
┌─────────────────────────────────────────────────────────────────┐
│ NEW USER JOURNEY │
├─────────────────────────────────────────────────────────────────┤
│ │
│ User → Mirror.onion │
│ │ │
│ ├─ No token? → Redirect to CAPTCHA │
│ │ │
│ ▼ │
│ Gate CAPTCHA Challenge │
│ │ │
│ ├─ SOLVED ──────────────┐ │
│ │ │ │
│ ▼ ▼ │
│ Verification Token [FAILED → Try Again] │
│ (60s, single-use) │
│ │ │
│ ▼ │
│ First Request → Upgrade to Session Token │
│ │ (24hr, reusable) │
│ │ │
│ ▼ │
│ ✓ Access Real Site (Verified tier: 100 req/10s) │
│ │
└─────────────────────────────────────────────────────────────────┘
┌─────────────────────────────────────────────────────────────────┐
│ DDOS ATTACK SCENARIO │
├─────────────────────────────────────────────────────────────────┤
│ │
│ Attack Bot #1 ──┐ │
│ Attack Bot #2 ──┤ │
│ Attack Bot #3 ──┼─► Mirror.onion │
│ Attack Bot #N ──┘ │ │
│ │ │
│ ▼ │
│ Rate Limiter (per-circuit) │
│ │ │
│ ├─ Bot #1: 10 req/10s → BLOCKED ❌ │
│ ├─ Bot #2: 10 req/10s → BLOCKED ❌ │
│ ├─ Bot #3: 10 req/10s → BLOCKED ❌ │
│ └─ Each bot isolated, can't exhaust quota │
│ │
│ Real User ─────────────────────────────────┐ │
│ │ │
│ ▼ │
│ Rate Limiter │
│ │ │
│ ├─ Independent quota│
│ ├─ 3 requests → ✓ │
│ │ │
│ ▼ │
│ CAPTCHA Challenge │
│ │ │
│ ├─ Solved → ✓ │
│ │ │
│ ▼ │
│ Access Site ✓ │
│ │
│ Result: Bots blocked, real users unaffected │
│ │
└─────────────────────────────────────────────────────────────────┘
┌─────────────────────────────────────────────────────────────────┐
│ BEHAVIORAL VIOLATION FLOW │
├─────────────────────────────────────────────────────────────────┤
│ │
│ Verified User → Suspicious Behavior Detected │
│ │ (path scanning, bot UA, etc.) │
│ │ │
│ ├─ Violation Count: 1 ──► Warning logged │
│ ├─ Violation Count: 2 ──► Warning logged │
│ ├─ Violation Count: 3 ──► DEMOTE to Suspicious ⚠️ │
│ │ │
│ ▼ │
│ Redirect to Gate │
│ │ │
│ ▼ │
│ Re-verification Challenge (2x CAPTCHAs) │
│ │ │
│ ├─ Both Solved ──────┐ │
│ │ │ │
│ ▼ ▼ │
│ Re-issue Token [FAILED → BURNED 🔥] │
│ │ (permanent ban) │
│ │ │
│ ▼ │
│ ✓ Return to Site (Verified tier restored) │
│ │
└─────────────────────────────────────────────────────────────────┘
┌─────────────────────────────────────────────────────────────────────┐
│ FORTIFY LAYERS │
├─────────────────────────────────────────────────────────────────────┤
│ │
│ ┌────────────────────────────────────────────────────────────┐ │
│ │ EXTERNAL (Untrusted) │ │
│ │ • Tor Network │ │
│ │ • Mirror Onion Addresses │ │
│ │ • User Connections │ │
│ └──────────────────────┬──────────────────────────────────────┘ │
│ │ │
│ ▼ │
│ ┌────────────────────────────────────────────────────────────┐ │
│ │ BOUNDARY LAYER │ │
│ │ ┌──────────────────┐ ┌────────────┐ ┌─────────────┐ │ │
│ │ │ HTTP PROXY │ │ GATE │ │ BEHAVIORAL │ │ │
│ │ │ Token Validation │ │ CAPTCHA │ │ ANALYSIS │ │ │
│ │ │ Rate Limiting │ │ Verification│ │ Detection │ │ │
│ │ └──────────────────┘ └────────────┘ └─────────────┘ │ │
│ └──────────────────────┬──────────────────────────────────────┘ │
│ │ │
│ ▼ │
│ ┌────────────────────────────────────────────────────────────┐ │
│ │ INTERNAL (Trusted) │ │
│ │ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐ │ │
│ │ │ CONTROLLER │ │ ORCHESTRATOR │ │ NODES │ │ │
│ │ │ Service │ │ Mirror │ │ Healthy/ │ │ │
│ │ │ Management │ │ Management │ │ Threat │ │ │
│ │ └──────────────┘ └──────────────┘ └──────────────┘ │ │
│ └──────────────────────┬──────────────────────────────────────┘ │
│ │ │
│ ▼ │
│ ┌────────────────────────────────────────────────────────────┐ │
│ │ PROTECTED (Your Service) │ │
│ │ • Real Hidden Service │ │
│ │ • Backend Application │ │
│ │ • Real Onion Address │ │
│ └────────────────────────────────────────────────────────────┘ │
│ │
└─────────────────────────────────────────────────────────────────────┘
Components:
- Controller: Service lifecycle management, health monitoring
- Orchestrator: Mirror creation and rotation
- HTTP Proxy: Request routing, token validation, rate limiting
- Gate: CAPTCHA challenges and verification
- Nodes: Backend proxying with behavioral analysis
| Tier | Access | Rate Limit | How to Achieve |
|---|---|---|---|
| Trusted | ✅ Yes | 120 req/min | Consistent good behavior |
| Verified | ✅ Yes | 60 req/min | Solve CAPTCHA |
| Stranger | ❌ No | 30 req/min | New visitor (requires CAPTCHA) |
| Suspicious | 10 req/min | Failed verification or rate limited | |
| Hostile | ❌ Never | Banned | Multiple violations |
Detected Violations:
- Path traversal attempts (
../,/.env) - Bot User-Agents (curl, wget, python-requests)
- Path enumeration (sequential scanning)
- Resource enumeration (rapid unique paths)
- Form submission floods
- Attack path access (admin panels, config files)
Severity Levels:
- Level 3: Attack path access, automated behavior
- Level 2: Bot UA, enumeration, form floods
- Level 1: Suspicious referer, payload anomalies
7 JavaScript-Free Types:
- BmpText: Traditional text image
- Emoji: Select matching emoji
- Direction: Click correct arrow
- Sequence: Complete the pattern
- WordUnscramble: Unscramble letters
- ImageRotation: Select upright image
- Silhouette: Identify silhouette
Features:
- No JavaScript required (Tor Browser "Safest" mode compatible)
- Single-use verification tokens (60s lifetime)
- User-Agent binding (prevents token sharing)
- Atomic check-and-mark (prevents race conditions)
Defense Capabilities:
- Per-circuit isolation prevents quota exhaustion
- Independent quotas for each Tor circuit
- CAPTCHA paths always accessible (no rate limit)
- Attack traffic blocked at circuit level
- Zero impact on legitimate users during attacks
Traffic Tiers:
Fortify auto-scales based on your expected traffic. RAM includes ~1GB OS overhead for Ubuntu Server:
| Tier | Daily Users | CPU | RAM (Total) | Disk |
|---|---|---|---|---|
| Micro | ~100 | 1-2 cores | 2GB | 1GB |
| Small | ~1,000 | 2-4 cores | 2-3GB | 2GB |
| Medium | ~10,000 | 2-4 cores | 3-4GB | 3GB |
| Large | ~100,000 | 4-8 cores | 5-8GB | 6GB |
| Enterprise | ~1M+ | 4-8 cores | 8-16GB | 10GB+ |
Note: Enterprise tier is optimized for Tor network constraints. Tor hidden services have natural throughput limits.
Core Documentation:
- Alpha Review - Project status and roadmap
- Architecture Overview - System design
- Trust Tiers - Trust system details
- Behavioral Analysis - Violation detection
- API Reference - Gate and Admin APIs
Specialized Guides:
- Rate Limiting - Circuit-based rate limiting system
- Authentication - Admin authentication
- Security Audit - Vulnerability assessment
Research:
- Tor Hidden Service Attacks - Attack vectors and defenses
fortify/
├── crates/
│ ├── fortify-core/ # Shared types, trust system, behavioral analysis
│ ├── fortify-controller/ # Service lifecycle management
│ ├── fortify-orchestrator/ # Mirror management
│ ├── fortify-http/ # HTTP proxy, rate limiting, routing
│ ├── fortify-gate/ # CAPTCHA verification
│ ├── fortify-node/ # Backend proxy nodes
│ ├── fortify-community/ # Community network (Phase 7)
│ └── fortify-tui/ # Deployment TUI (40% complete)
├── config/ # Example configurations
├── docs/ # Documentation
├── install/ # Installation scripts
├── scripts/ # Utility scripts
└── tests/ # Integration tests
# Development build
cargo build
# Release build (optimized)
cargo build --release
# Run tests
cargo test
# Run specific crate
cargo run -p fortify-controller
# Build documentation
cargo doc --no-deps --open- Mirror discovery bar and retirement system
- Auto-scaling based on resource usage
- Session behavioral analysis enhancements
- Hot-reload with session juggling (stagger changes across nodes to maintain uptime)
- Cleanup automation
- Multi-VPS coordination
- Distributed mirror management
- Cross-cluster session sharing
- Cluster-wide health monitoring
- ✅ Core framework and configuration system
- ✅ Deployment wizard (7 steps)
- ✅ Live log streaming
- ✅ Traffic tier auto-scaling
- ⏳ Controller integration
- ⏳ Full settings hot-reload
- P2P mirror discovery
- Community node registration
- Trust verification system
- Reputation tracking
- Machine learning threat detection
- Predictive scaling algorithms
- Advanced behavioral analysis
- Traffic pattern recognition
Fortify is currently in Alpha development. Contributions are welcome!
Areas needing help:
- Testing and bug reports
- Documentation improvements
- CAPTCHA type implementations
- Performance optimizations
Before contributing:
- Read the Security Audit
- Review the Alpha Review
- Check existing issues and PRs
This project is licensed under the MIT License - see the LICENSE file for details.
Fortify is provided as-is for educational and defensive purposes. The authors are not responsible for misuse. Always comply with applicable laws when deploying hidden services.
- Built with Rust 🦀
- Tor Project for the anonymity network
- The security research community
Built by Nespartious | GitHub | Alpha Release
Protecting hidden services, one CAPTCHA at a time. 🏰