Re: [ANNOUNCE] new iptables module match large amount of ip addresses

[Fred Moyer <fred@redhotpenguin.com>]

On Thu, Sep 17, 2009 at 12:15 PM, Mikulas Patocka
<mikulas@artax.karlin.mff.cuni.cz> wrote:
> Hi
>
> Here I submit an iptables module that can match large amounts (millions)
> of ip addresses efficiently using binary search. I needed it to protect my
> home network from spam. It may be useful for other people too, so if you
> want it, you can take it and add it to the kernel.

I'm not familiar with xt_geoip or ipset, but from the first look at
this module I want to say thank you!  This is the perfect tool for a
problem I have been wanting to solve for a while.



>
> Get the patches for netfilter and kernel at:
> http://artax.karlin.mff.cuni.cz/~mikulas/xt_ipfile/
> (you need to copy the file include/linux/netfilter/xt_ipfile.h from kernel
> sources to /usr/include/linux/netfilter/ to compile the userspace)
>
> The main features:
> - fast matching of large amount of ip addresses using binary search.
> - an ability to match ranges of addresses or address/mask subnets.
> - fast loading of the addresses (on Pentium 3 850, 2 million addresses
> load in 5.5s, if they are already sorted in the file, the load time is
> just 1.5s).
> - memory efficient --- consumes only 8 bytes per address.
>
> USAGE:
>
> prepare a file with addreses, in this example /root/firewall/bad-ips. One
> entry per line, the allowed formats are:
> 1.2.3.4
> 1.2.3.0/24
> 1.2.3.4-1.2.3.8
>
> insert it into iptables with:
> iptables -A SPAM -m ipfile --src-file /root/firewall/bad-ips -j DROP
>
> The module doesn't support ipv6 because I don't use it, but it's generic
> enough that it could be extended for it. It could be also extended to
> match ethernet MAC addresses.
>
> Mikulas
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html