best approach for blocklist

best approach for blocklist

[Dennis J.]

Hi,
I'm wondering what the most efficient way to implement a blocklist is. We 
are basically talking about blocking a few thousand IPs. Does iptables do 
some internal optimizations when blocking based on a source address or 
would it be better to, say, create a chain for each class A net (e.g. 
83.0.0.0/8) and then add the IPs in that range to that class to make the 
matching more efficient?

Regards,
   Dennis

Re: best approach for blocklist

[Payam Chychi]

anytime where you can use chains to jump from and not have to go
through a massive list its a good thing... id take the later option


-- 
Payam Tarverdyan Chychi
Network Security Specialist / Network Engineer

On Fri, Mar 5, 2010 at 8:17 AM, Dennis J. <dennisml@conversis.de> wrote:
> Hi,
> I'm wondering what the most efficient way to implement a blocklist is. We
> are basically talking about blocking a few thousand IPs. Does iptables do
> some internal optimizations when blocking based on a source address or would
> it be better to, say, create a chain for each class A net (e.g. 83.0.0.0/8)
> and then add the IPs in that range to that class to make the matching more
> efficient?
>
> Regards,
>  Dennis
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>

Re: best approach for blocklist

[Mike Wright]

Dennis J. wrote:
> Hi,
> I'm wondering what the most efficient way to implement a blocklist is. 
> We are basically talking about blocking a few thousand IPs. Does 
> iptables do some internal optimizations when blocking based on a source 
> address or would it be better to, say, create a chain for each class A 
> net (e.g. 83.0.0.0/8) and then add the IPs in that range to that class 
> to make the matching more efficient?

Have you considered ipset?  I use it in various ways, sometimes to 
allow, sometimes to deny.  It supports IPs, NETs, ports, etc.

Re: best approach for blocklist

[Mart Frauenlob]

On 05.03.2010 17:17, netfilter-owner@vger.kernel.org wrote:
> Hi,
> I'm wondering what the most efficient way to implement a blocklist is.
> We are basically talking about blocking a few thousand IPs. Does
> iptables do some internal optimizations when blocking based on a source
> address or would it be better to, say, create a chain for each class A
> net (e.g. 83.0.0.0/8) and then add the IPs in that range to that class
> to make the matching more efficient?
> 
> Regards,
>   Dennis

things i would take into consideration:

- drop in raw table (avoid conntrack)
- use user-defined chains
- use ipset to match many IPs

best regards

Mart

Re: best approach for blocklist

[Weedy]

Mart Frauenlob wrote:
> On 05.03.2010 17:17, netfilter-owner@vger.kernel.org wrote:
>> Hi,
>> I'm wondering what the most efficient way to implement a blocklist is.
>> We are basically talking about blocking a few thousand IPs. Does
>> iptables do some internal optimizations when blocking based on a source
>> address or would it be better to, say, create a chain for each class A
>> net (e.g. 83.0.0.0/8) and then add the IPs in that range to that class
>> to make the matching more efficient?

There is a PDF I'm too lazy to google for about how the university of 
florida mitigated a DDOS from a worm using TARPIT. Point being they had 
to TARPIT hundreds of thousands of IPs and had to deal with the 
performance issues behind that. It's a good read.