9

Say one wishes to have a list of blocked IP addresses.

I have seen the following example script:

BLOCKDB="/path/to/ip.blocked.file"
# omit comments lines
IPS=$(grep -Ev "^#" $BLOCKDB)
for i in $IPS
do
    iptables -A INPUT -s $i -j DROP
    iptables -A OUTPUT -d $i -j DROP
done

Is several thousand lines, which transform into several thousand iptables entries, sane?

What is the top limit, beyond which, system efficiency will gets significantly affected?

1
  • 2
    It appears that you found the answer to your question. If so, you should move the answer out of your question and use the "Answer your question" button and post the answer there. Then, you can accept your answer and things will be much more nicely organized. Nov 4, 2011 at 13:28

1 Answer 1

8

I think I have found a solution via this article and IPSet seems to be the answer

In sum:

If set of IP addresses contain thousands of items iptables performance decreases (actually, performance of netfilter, as soon as iptables is just a tool for managing firewall). Your CPU load can increase too. Fortunately there is a perfect solution – ipsets

IPSet is the perfect tool if you want to:

  • Store multiple IP addresses or port numbers and match against the collection by iptables at one swoop;
  • Dynamically update iptables rules against IP addresses or ports without performance penalty;
  • Express complex IP address and ports based rulesets with one single iptables rule and benefit from the speed of IP sets

Installing ipset is straight forward sudo apt-get install ipset

Then run the following

ipset -N autoban iphash ––hashsize 4096 ––probes 2 ––resize 50

Add it to your iptables chain. It can differ depending on your firewall settings. Here we use ethin chain.

iptables -I ethin 2 -p tcp -m multiport ––dport 80,443 -m set ––match-set autoban src -j DROP

Now you can add all bad IP to your ipset. For instance, you have text file called bots.txt with one IP per line. So you can add them to ipset using simple bash script:

for i in $( cat /tmp/bots.txt ) ; do ipset -A autoban $i ; done

To check run:

ipset -L autoban
1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .