Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

Say one wishes to have a list of blocked IP addresses.

I have seen the following example script:

BLOCKDB="/path/to/ip.blocked.file"
# omit comments lines
IPS=$(grep -Ev "^#" $BLOCKDB)
for i in $IPS
do
    iptables -A INPUT -s $i -j DROP
    iptables -A OUTPUT -d $i -j DROP
done

Is several thousand lines, which transform into several thousand iptables entries, sane?

What is the top limit, beyond which, system efficiency will gets significantly affected?

share|improve this question
2  
It appears that you found the answer to your question. If so, you should move the answer out of your question and use the "Answer your question" button and post the answer there. Then, you can accept your answer and things will be much more nicely organized. –  Scott Severance Nov 4 '11 at 13:28
    
@ScottSeverance done as you suggest, however, it takes 4 hours until one can accept self answer. –  Tzury Bar Yochay Nov 6 '11 at 3:12
add comment

1 Answer 1

up vote 5 down vote accepted

I think I have found a solution via this article and IPSet seems to be the answer

In sum:

If set of IP addresses contain thousands of items iptables performance decreases (actually, performance of netfilter, as soon as iptables is just a tool for managing firewall). Your CPU load can increase too. Fortunately there is a perfect solution – ipsets

IPSet is the perfect tool if you want to:

  • Store multiple IP addresses or port numbers and match against the collection by iptables at one swoop;
  • Dynamically update iptables rules against IP addresses or ports without performance penalty;
  • Express complex IP address and ports based rulesets with one single iptables rule and benefit from the speed of IP sets

Installing ipset is straight forward sudo apt-get install ipset

Then run the following

ipset -N autoban iphash ––hashsize 4096 ––probes 2 ––resize 50

Add it to your iptables chain. It can differ depending on your firewall settings. Here we use ethin chain.

iptables -I ethin 2 -p tcp -m multiport ––dport 80,443 -m set ––match-set autoban src -j DROP

Now you can add all bad IP to your ipset. For instance, you have text file called bots.txt with one IP per line. So you can add them to ipset using simple bash script:

for i in $( cat /tmp/bots.txt ) ; do ipset -A autoban $i ; done

To check run:

ipset -L autoban
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.