Date: Tue, 20 Jun 2006 14:07:22 -0700 From: Luigi Rizzo <rizzo@icir.org> To: Brett Glass <brett@lariat.org>, net@freebsd.org, Phil Regnauld <regnauld@catpipe.net> Subject: Re: Best way to block a long list of IPs? Message-ID: <20060620140722.A1192@xorpc.icir.org> In-Reply-To: <20060620205730.GC3968@catpipe.net>; from regnauld@catpipe.net on Tue, Jun 20, 2006 at 10:57:30PM %2B0200 References: <7.0.1.0.2.20060620143845.06662330@lariat.org> <20060620205730.GC3968@catpipe.net>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, Jun 20, 2006 at 10:57:30PM +0200, Phil Regnauld wrote: > Brett Glass (brett) writes: > > > > I've got an application in which I must block incoming TCP > > connections to a FreeBSD server from a potentially large list of IP > > addresses. Using IPFW is not a very efficient way to accomplish > > this, because it must do a linear search of a list (either one > > address per rule or an "or" list in a rule) and this could slow > > down every packet entering the machine dramatically. > > pf tables are VERY efficient -- man pf.conf there are efficient tables in ipfw as well, which Ruslan implemented some time ago -- yet another reason we should be grateful to him http://people.freebsd.org/~ru/help/en/ and also, if your address are in the same /24 subnet, you can use the ipfw address set format which looks like this 1.2.3.0/24{10,20,21,30,34,55} and can deal in constant time for up to 256 randomly distributed hosts. man ipfw has all the details. cheers luigi > _______________________________________________ > freebsd-net@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-net > To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org"
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20060620140722.A1192>