iptable how many rule can manage iptable

iptable how many rule can manage iptable

[Mamadou Touré]

Hi, all
i'd like to know how many rule can manage iptable.
I'm asking that because i'd to drop all traffric from my localnet to porn site.
I've a database of porn site witch contain about 900 000  domains.
I know there are solutions like squidguard. But for my linux box i'd
to use iptable to prevent users access to porn site and other
blacklist site.
I waiting for your advices.
regards.

Re: iptable how many rule can manage iptable

[Jan Engelhardt]

On Wednesday 2010-05-12 19:09, Mamadou Touré wrote:

>Hi, all
>i'd like to know how many rule can manage iptable.

It depends on the amount of memory you have available at the time of 
loading/modifying a table.

Re: iptable how many rule can manage iptable

[Mamadou Touré]

Hi thank you for your reply.
how could i evaluate the quantity of memories.
for example of 1 000 000 rules what quantity should i have a least.
regards
2010/5/12 Jan Engelhardt <jengelh@medozas.de>:
> On Wednesday 2010-05-12 19:09, Mamadou Touré wrote:
>
>>Hi, all
>>i'd like to know how many rule can manage iptable.
>
> It depends on the amount of memory you have available at the time of
> loading/modifying a table.
>

Re: iptable how many rule can manage iptable

[Jan Engelhardt]

On Wednesday 2010-05-12 20:05, Mamadou Touré wrote:

>Hi thank you for your reply.
>how could i evaluate the quantity of memories.
>for example of 1 000 000 rules what quantity should i have a least.

If you use `iptables -vvS`, you see:

libiptc vlibxtables.so.4. 5332 bytes.

Which is the size of the current table. Multiply that by NR_CPUS 
(from /proc/config) to get what it's taking up (we're on to reducing 
that).

Fwd: iptable how many rule can manage iptable

[Mistick Levi]

---------- Forwarded message ----------
From: Mistick Levi <gmistick@gmail.com>
Date: 2010/5/12
Subject: Re: iptable how many rule can manage iptable
To: Mamadou Touré <e2ia.ci@gmail.com>
Cc: netfilter@vger.kernel.org


Hi,
You could use the hosts files (/etc/hosts.deny .. hosts.allow ) in
order to do so,
Im not sure what will be a greater performance penalty, setting a tons
of rules or the hosts file,
because after you edit the hosts file , every query of dns will go
through this long list before going out to the dns server....
put it to the test?

2010/5/12 Jan Engelhardt <jengelh@medozas.de>
>
> On Wednesday 2010-05-12 20:05, Mamadou Touré wrote:
>
> >Hi thank you for your reply.
> >how could i evaluate the quantity of memories.
> >for example of 1 000 000 rules what quantity should i have a least.
>
> If you use `iptables -vvS`, you see:
>
> libiptc vlibxtables.so.4. 5332 bytes.
>
> Which is the size of the current table. Multiply that by NR_CPUS
> (from /proc/config) to get what it's taking up (we're on to reducing
> that).
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: iptable how many rule can manage iptable

[Marek Kierdelewicz]

>Hi, all

Hi,

>i'd like to know how many rule can manage iptable.
>I'm asking that because i'd to drop all traffric from my localnet to
>porn site. I've a database of porn site witch contain about 900 000
>domains. I know there are solutions like squidguard. But for my linux
>box i'd to use iptable to prevent users access to porn site and other
>blacklist site.

It's not feasible to implement 900 000 long ruleset in iptables
even with ipset extension or with fancy hierarchical chains. The
other problem is that iptables works on ip addresses and your database
is comprised of domains. There can be more then one site on single ip
address. Blocking IPs and not domains could cut access to some legit
sites.

Squid+squidguard is good option. I've heard of some dns based
solutions (domain blacklisting on dnscache level), but I don't know any
actual software.

Best regards,
Marek

Re: iptable how many rule can manage iptable

[Mart Frauenlob]

>> i'd like to know how many rule can manage iptable.
>> I'm asking that because i'd to drop all traffric from my localnet to
>> porn site. I've a database of porn site witch contain about 900 000
>> domains. I know there are solutions like squidguard. But for my linux
>> box i'd to use iptable to prevent users access to porn site and other
>> blacklist site.
> 
> It's not feasible to implement 900 000 long ruleset in iptables
> even with ipset extension or with fancy hierarchical chains. The
> other problem is that iptables works on ip addresses and your database
> is comprised of domains. There can be more then one site on single ip
> address. Blocking IPs and not domains could cut access to some legit
> sites.
> 
> Squid+squidguard is good option. I've heard of some dns based
> solutions (domain blacklisting on dnscache level), but I don't know any
> actual software.
i.e.

http://www.peereboom.us/adsuck/

adsuck is a small dns server that spoofs blacklisted addresses and
forwards all other queries. The idea is to be able to prevent
connections to undesirable sites such as ad servers, crawlers, etc. It
can be used locally, for the road warrior, or on the network perimeter
in order to protect local machines from malicious sites.