best approach for blocklist
Hi,
I'm wondering what the most efficient way to implement a blocklist is. We are basically talking about blocking a few thousand IPs. Does iptables do some internal optimizations when blocking based on a source address or would it be better to, say, create a chain for each class A net (e.g. 83.0.0.0/8) and then add the IPs in that range to that class to make the matching more efficient?
Regards,
Dennis
anytime where you can use chains to jump from and not have to go through a massive list its a good thing... id take the later option
Signature · 2 lines
Payam Tarverdyan Chychi Network Security Specialist / Network Engineer
Quoted 15 lines · Dennis J.
Hi,
I'm wondering what the most efficient way to implement a blocklist is. We are basically talking about blocking a few thousand IPs. Does iptables do some internal optimizations when blocking based on a source address or would it be better to, say, create a chain for each class A net (e.g. 83.0.0.0/8) and then add the IPs in that range to that class to make the matching more efficient?Regards,
Dennis
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Quoted 2 lines · Dennis J.
Hi,
I'm wondering what the most efficient way to implement a blocklist is. We are basically talking about blocking a few thousand IPs. Does iptables do some internal optimizations when blocking based on a source address or would it be better to, say, create a chain for each class A net (e.g. 83.0.0.0/8) and then add the IPs in that range to that class to make the matching more efficient?
Have you considered ipset? I use it in various ways, sometimes to allow, sometimes to deny. It supports IPs, NETs, ports, etc.
Quoted 10 lines · On 05.03.2010 17:17, [email protected] wrote:
Hi,
I'm wondering what the most efficient way to implement a blocklist is. We are basically talking about blocking a few thousand IPs. Does iptables do some internal optimizations when blocking based on a source address or would it be better to, say, create a chain for each class A net (e.g. 83.0.0.0/8) and then add the IPs in that range to that class to make the matching more efficient?Regards,
Dennis
things i would take into consideration:
- drop in raw table (avoid conntrack)
- use user-defined chains
- use ipset to match many IPs
best regards
Mart
Quoted 8 lines · Mart Frauenlob
Quoted 7 lines · On 05.03.2010 17:17, [email protected] wrote:
Hi,
I'm wondering what the most efficient way to implement a blocklist is. We are basically talking about blocking a few thousand IPs. Does iptables do some internal optimizations when blocking based on a source address or would it be better to, say, create a chain for each class A net (e.g. 83.0.0.0/8) and then add the IPs in that range to that class to make the matching more efficient?
There is a PDF I'm too lazy to google for about how the university of florida mitigated a DDOS from a worm using TARPIT. Point being they had to TARPIT hundreds of thousands of IPs and had to deal with the performance issues behind that. It's a good read.