Skip to contentSkip to conversation

maximum number of iptables rules?

DISCUSSION px 2 participants 2 messages Nov 12, 2003

lore
Share & tools
lore

px

author
#0 lore raw

Hi, me and a buddy of mine are working on a perl script to automate blocking of about 3000 IP addresses.
The script works fine on his box, x86. But on my box, sparc, I seem to have a limitation of 854 rules before I start to get errors and am unable to add anymore rules. Is there a maximum number of rules per chain? or overall?

Here is the information on my Sparc box.

Quoted 10 lines
null:~# iptables -t filter -I INPUT 1 -s 66.28.224.0/19 -p all -j blockme
iptables: Memory allocation problem
null:~# iptables -t filter -I INPUT 1 -s 1.2.3.4/19 -p all -j blockme
iptables: Memory allocation problem
null:~# uname -a
Linux null 2.4.21 #1 Thu Aug 7 20:30:12 EDT 2003 sparc64 GNU/Linux
null:~#
Quoted 4 lines
null:~# iptables -L blockme
Chain blockme(854 references)
target     prot opt source               destination
DROP       all  --  anywhere             anywhere

Here is the info about my buddy's. x86 box

Quoted 8 lines
 root@darkside:/etc/rc.d# uname -a; iptables -L blockme; iptables 
--version
 Linux darkside 2.5.50-ac1 #3 SMP Sun Feb 9 10:21:53 PST 2003 i686 
unknown
 Chain blockme(3966 references)
 target     prot opt source               destination          
 DROP       all  --  anywhere             anywhere            
 iptables v1.2.7a

Any help is greatly appreciated.
-r0b

#1 lore raw
Quoted 5 lines · px

Hi, me and a buddy of mine are working on a perl script to automate blocking of about 3000 IP addresses.
The script works fine on his box, x86. But on my box, sparc, I seem to have a limitation of 854 rules before I start to get errors and am unable to add anymore rules.

Tell us more about both machines - especially how much memory they each have.

Antony.

Signature · 6 lines
If books were designed by Microsoft, the Anarchist's Cookbook would explode 
when you read it.

 - Mark W Schumann
                                                     Please reply to the list;
                                                           please don't CC me.