Table-based branching

Table-based branching

[Philipp Gühring]

Hi!

I am working on a scalable captive Portal Gateway software.
I have several huge networks (/20) that have to be managed individually per IP 
address.
For every IP adress I have to store in a table, whether that IP Address is 
allowed or not yet allowed.
When an IP address is allowed, it either has to be router or NATed, depending 
on the network address.

When an IP address is not allowed, all Traffic has to be redirected to the 
captive portal on the firewall.

My idea now is to have different rule tables for allowed and disallowed IP 
addresses, and special kernel module that branches into either rule table.
That module contains a large Bit-Array in kernel memory to store for every IP 
addresse whether it is allowed or disallowed.

Has anyone done that before (or something similar)?

Is it a bad idea to do it that way?

Many greetings,
Philipp Gühring

Table-based branching

[Philipp Gühring]

Hi!

I am working on a scalable captive Portal Gateway software.
I have several huge networks (/20) that have to be managed individually per IP 
address.
For every IP adress I have to store in a table, whether that IP Address is 
allowed or not yet allowed.
When an IP address is allowed, it either has to be router or NATed, depending 
on the network address.

When an IP address is not allowed, all Traffic has to be redirected to the 
captive portal on the firewall.

My idea now is to have different rule tables for allowed and disallowed IP 
addresses, and special kernel module that branches into either rule table.
That module contains a large Bit-Array in kernel memory to store for every IP 
addresse whether it is allowed or disallowed.

Has anyone done that before (or something similar)?

Is it a bad idea to do it that way?

Many greetings,
Philipp Gühring

Re: Table-based branching

[KOVACS Krisztian]

  Hi,

On Mon, 2004-04-05 at 17:27, Philipp Gühring wrote:
> My idea now is to have different rule tables for allowed and disallowed IP 
> addresses, and special kernel module that branches into either rule table.
> That module contains a large Bit-Array in kernel memory to store for every IP 
> addresse whether it is allowed or disallowed.
> 
> Has anyone done that before (or something similar)?

  Of course! Take a look at the old ippool, or the new ipset module.
(Modules 'pool' and 'set' in Patch-o-matic-NG.) The ippool module does
exactly what you described, the ipset addon by Jozsef Kadlecsik is much
more powerful.

-- 
 Regards,
   Krisztian KOVACS

Re: Table-based branching

[zhi wang]

> My idea now is to have different rule tables for allowed and disallowed IP 
> addresses, and special kernel module that branches into either rule table.
> That module contains a large Bit-Array in kernel memory to store for every IP
> 
I think you can make the "module" a match. This match contains a bit map for
every allowed IP. Then add two rules, one says, "if this match succeeds, jump
to allowed IP rule table". The other rule says, "jump to disallowed IP rule
table". 

__________________________________
Do you Yahoo!?
Yahoo! Small Business $15K Web Design Giveaway 
http://promotions.yahoo.com/design_giveaway/