Table-based branching

["Philipp Gühring" <mailinglists@futureware.at>]

Hi!

I am working on a scalable captive Portal Gateway software.
I have several huge networks (/20) that have to be managed individually per IP 
address.
For every IP adress I have to store in a table, whether that IP Address is 
allowed or not yet allowed.
When an IP address is allowed, it either has to be router or NATed, depending 
on the network address.

When an IP address is not allowed, all Traffic has to be redirected to the 
captive portal on the firewall.

My idea now is to have different rule tables for allowed and disallowed IP 
addresses, and special kernel module that branches into either rule table.
That module contains a large Bit-Array in kernel memory to store for every IP 
addresse whether it is allowed or disallowed.

Has anyone done that before (or something similar)?

Is it a bad idea to do it that way?

Many greetings,
Philipp Gühring