# STUN server misuse
**URL:** https://forum.syncthing.net/t/stun-server-misuse/23319
**Category:** General
**Created:** [November 28, 2024, 7:30pm UTC](https://forum.syncthing.net/t/stun-server-misuse/23319 "2024-11-28T19:30:05Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@calmh](https://forum.syncthing.net/u/calmh)
#### Post date: [November 28, 2024, 7:30pm UTC](https://forum.syncthing.net/t/stun-server-misuse/23319/1 "2024-11-28T19:30:05Z")
Looks like someone pointed their client base at our STUN server, average usage went up from about 10 Mbps on average to about 100 Mbps on average over the last couple of weeks.
If you’re reading this, can you please not? 😬
---
### Author:  [@bt90](https://forum.syncthing.net/u/bt90)
#### Post date: [November 28, 2024, 7:41pm UTC](https://forum.syncthing.net/t/stun-server-misuse/23319/2 "2024-11-28T19:41:18Z")
Do we know what region the clients are connecting from? This may help to trace the origin.
---
### Author:  [@calmh](https://forum.syncthing.net/u/calmh)
#### Post date: [November 28, 2024, 7:49pm UTC](https://forum.syncthing.net/t/stun-server-misuse/23319/3 "2024-11-28T19:49:26Z")
Here’s the packet count by first three octets of the source addresses of clients for about 30 seconds of traffic, sorted:
[https://cdn.kastelo.net/tfi/30-sek-ips.txt](https://cdn.kastelo.net/tfi/30-sek-ips.txt)
There’s a lot of Chinese networks at the bottom.
---
### Author:  [@chaos](https://forum.syncthing.net/u/chaos)
#### Post date: [November 28, 2024, 7:50pm UTC](https://forum.syncthing.net/t/stun-server-misuse/23319/4 "2024-11-28T19:50:33Z")
Would it make sense to drop or tarpit STUN connections that don’t coincide with an IP visible in the Global Discovery servers list? I’m no expert on STUN or Syncthing’s public infrastructure, so if this is a bad idea for some reason, it won’t hurt my feelings.
---
### Author:  [@calmh](https://forum.syncthing.net/u/calmh)
#### Post date: [November 28, 2024, 7:53pm UTC](https://forum.syncthing.net/t/stun-server-misuse/23319/5 "2024-11-28T19:53:35Z")
That was one of my thoughts as well. Apart from it being a big and churning list of addresses, STUN will predate the announcement to discovery, since that address is supposed to be in the discovery, so there’s a chicken and egg problem.
That said, I think we mainly use STUN for port discovery? The source address seen by the discovery server should be the same as for the STUN packets presumably, even before STUN is completed… Maybe this would in fact be a workable mechanism, even though it’s a bit heavy handed…
There’s an authentication field we could use in STUN, and we could set a client ID and filter on that, but that’s only effective for new clients…
(There are quite a few packets with a client ID that’s _not_ Syncthing though, `StunClient` which is the default for at least the Go STUN library, but most seem to be using blank client ID like Syncthing currently does…)
---
### Author:  [@calmh](https://forum.syncthing.net/u/calmh)
#### Post date: [November 28, 2024, 9:31pm UTC](https://forum.syncthing.net/t/stun-server-misuse/23319/6 "2024-11-28T21:31:23Z")
Adding a drop rule for Chinese sources skips about 65 % of the traffic.
```plaintext
root@stun:~# iptables -L -v
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
4840K 288M DROP all -- any any anywhere anywhere match-set china src
2646K 156M ACCEPT all -- any any anywhere anywhere
```
---
### Author:  [@AndASM](https://forum.syncthing.net/u/AndASM)
#### Post date: [November 28, 2024, 11:12pm UTC](https://forum.syncthing.net/t/stun-server-misuse/23319/7 "2024-11-28T23:12:07Z")
Doing a github code search shows quite a few projects and libraries using the syncthing servers. Because there are libraries using it, there may be projects using those servers without even realizing.
---
### Author:  [@calmh](https://forum.syncthing.net/u/calmh)
#### Post date: [November 28, 2024, 11:27pm UTC](https://forum.syncthing.net/t/stun-server-misuse/23319/8 "2024-11-28T23:27:11Z")
Yeah. I don’t mind the ones having it as one entry in a big list of STUN servers, we kind of do that as well, but the ones using _just_ [stun.syncthing.net](http://stun.syncthing.net) is a bit ☹
---
### Author:  [@calmh](https://forum.syncthing.net/u/calmh)
#### Post date: [November 29, 2024, 7:29am UTC](https://forum.syncthing.net/t/stun-server-misuse/23319/9 "2024-11-29T07:29:31Z")
Dropping incoming from China has brought our outgoing traffic down to under 20 Mbps which is a significant improvement. Unfortunately this leaves Chinese Syncthing users without access to our STUN server, but there are others they can use… Clearly I realise the hypocrisy of this, nonetheless we do need to keep the infrastructure running in a reasonable way.
---
### Author:  [@bt90](https://forum.syncthing.net/u/bt90)
#### Post date: [November 29, 2024, 12:38pm UTC](https://forum.syncthing.net/t/stun-server-misuse/23319/10 "2024-11-29T12:38:31Z")
Should we add some china based STUN servers to our list? I fear that most of our default servers are blocked by the Great Firewall.
e.g:
- [stun.qq.com:3478](http://stun.qq.com:3478) (Tencent)
- [stun.miwifi.com:3478](http://stun.miwifi.com:3478) (Xiaomi)
---
### Author:  [@calmh](https://forum.syncthing.net/u/calmh)
#### Post date: [November 29, 2024, 1:35pm UTC](https://forum.syncthing.net/t/stun-server-misuse/23319/11 "2024-11-29T13:35:18Z")
Sure, why not.
---
### Author:  [@bt90](https://forum.syncthing.net/u/bt90)
#### Post date: [November 29, 2024, 7:12pm UTC](https://forum.syncthing.net/t/stun-server-misuse/23319/12 "2024-11-29T19:12:48Z")
I tested a few services for [Add China-based STUN servers · Issue #9842 · syncthing/syncthing · GitHub](https://github.com/syncthing/syncthing/issues/9842) and came across this one:
`stun.cdnbye.com:3478`
It came up pretty often when looking for STUN servers in China. Now comes the fun part:
[https://dns.google/query?name=stun.cdnbye.com](https://dns.google/query?name=stun.cdnbye.com)
They’re pointing to [stun.syncthing.net](http://stun.syncthing.net) using a CNAME 🤡
---
### Author:  [@calmh](https://forum.syncthing.net/u/calmh)
#### Post date: [November 29, 2024, 7:27pm UTC](https://forum.syncthing.net/t/stun-server-misuse/23319/13 "2024-11-29T19:27:03Z")
fucks sake
---
### Author:  [@bt90](https://forum.syncthing.net/u/bt90)
#### Post date: [November 29, 2024, 7:40pm UTC](https://forum.syncthing.net/t/stun-server-misuse/23319/14 "2024-11-29T19:40:54Z")
A “could you fucking not?” mail might or might not help.
---
### Author:  [@Nummer378](https://forum.syncthing.net/u/Nummer378)
#### Post date: [November 29, 2024, 8:05pm UTC](https://forum.syncthing.net/t/stun-server-misuse/23319/15 "2024-11-29T20:05:52Z")
> [@bt90](#):
>
> [https://dns.google/query?name=stun.cdnbye.com](https://dns.google/query?name=stun.cdnbye.com)
>
> They’re pointing to [stun.syncthing.net](http://stun.syncthing.net) using a CNAME 🤡
Oh the irony 😀
---
### Author:  [@calmh](https://forum.syncthing.net/u/calmh)
#### Post date: [November 29, 2024, 8:07pm UTC](https://forum.syncthing.net/t/stun-server-misuse/23319/16 "2024-11-29T20:07:17Z")
Wonder if they’re actually using Syncthing under the hood? 🙂
---
### Author:  [@ProactiveServices](https://forum.syncthing.net/u/ProactiveServices)
#### Post date: [November 29, 2024, 9:08pm UTC](https://forum.syncthing.net/t/stun-server-misuse/23319/17 "2024-11-29T21:08:07Z")
I know what you’re thinking and you really should.
---
### Author:  [@sams](https://forum.syncthing.net/u/sams)
#### Post date: [December 1, 2024, 11:40pm UTC](https://forum.syncthing.net/t/stun-server-misuse/23319/18 "2024-12-01T23:40:22Z")
According to them, “[SwarmCloud is] Powered by WebRTC”.
---
### Author:  [@sams](https://forum.syncthing.net/u/sams)
#### Post date: [December 4, 2024, 2:16am UTC](https://forum.syncthing.net/t/stun-server-misuse/23319/19 "2024-12-04T02:16:37Z")
> [@calmh](#):
>
> someone pointed their client base at our STUN server,
Sorry for the n00b question, but are you sure these connections are coming from Syncthing, and that they’re just not some misconfigured program/system doing regular HTTP(S) requests?
---
### Author:  [@chaos](https://forum.syncthing.net/u/chaos)
#### Post date: [December 4, 2024, 2:21am UTC](https://forum.syncthing.net/t/stun-server-misuse/23319/20 "2024-12-04T02:21:31Z")
> [@sams](#):
>
> Sorry for the n00b question, but are you sure these connections are coming from Syncthing, and that they’re just not some misconfigured program/system doing regular HTTP(S) requests?
Neither.
STUN is a protocol that allows something behind a NAT device (typically a firewall) to discover its public IP address.
The nice people (not me, I don’t know who they are) who host the Syncthing infrastructure host some STUN server architecture, but without using any authentication at this time.
In other words, this big increase in traffic and load is coming from freeloaders who are using Synchthing’s infrastructure to do something else.
[Next page](https://forum.syncthing.net/t/stun-server-misuse/23319.md?page=2)