Re: iptable how many rule can manage iptable

[Marek Kierdelewicz <marek@piasta.pl>]

>Hi, all

Hi,

>i'd like to know how many rule can manage iptable.
>I'm asking that because i'd to drop all traffric from my localnet to
>porn site. I've a database of porn site witch contain about 900 000
>domains. I know there are solutions like squidguard. But for my linux
>box i'd to use iptable to prevent users access to porn site and other
>blacklist site.

It's not feasible to implement 900 000 long ruleset in iptables
even with ipset extension or with fancy hierarchical chains. The
other problem is that iptables works on ip addresses and your database
is comprised of domains. There can be more then one site on single ip
address. Blocking IPs and not domains could cut access to some legit
sites.

Squid+squidguard is good option. I've heard of some dns based
solutions (domain blacklisting on dnscache level), but I don't know any
actual software.

Best regards,
Marek