Re: best approach for blocklist

[Mike Wright <mike.wright@mailinator.com>]

Dennis J. wrote:
> Hi,
> I'm wondering what the most efficient way to implement a blocklist is. 
> We are basically talking about blocking a few thousand IPs. Does 
> iptables do some internal optimizations when blocking based on a source 
> address or would it be better to, say, create a chain for each class A 
> net (e.g. 83.0.0.0/8) and then add the IPs in that range to that class 
> to make the matching more efficient?

Have you considered ipset?  I use it in various ways, sometimes to 
allow, sometimes to deny.  It supports IPs, NETs, ports, etc.