From owner-freebsd-questions@FreeBSD.ORG Wed Jan 14 17:13:16 2009 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 01665106566B for ; Wed, 14 Jan 2009 17:13:16 +0000 (UTC) (envelope-from steve@ibctech.ca) Received: from ibctech.ca (v6.ibctech.ca [IPv6:2607:f118::b6]) by mx1.freebsd.org (Postfix) with SMTP id 8F6318FC13 for ; Wed, 14 Jan 2009 17:13:15 +0000 (UTC) (envelope-from steve@ibctech.ca) Received: (qmail 31804 invoked by uid 89); 14 Jan 2009 17:26:29 -0000 Received: from unknown (HELO ?IPv6:2607:f118::5?) (steve@ibctech.ca@2607:f118::5) by 2607:f118::b6 with ESMTPA; 14 Jan 2009 17:26:29 -0000 Message-ID: <496E1D22.9070106@ibctech.ca> Date: Wed, 14 Jan 2009 12:13:06 -0500 From: Steve Bertrand User-Agent: Thunderbird 2.0.0.17 (Windows/20080914) MIME-Version: 1.0 To: Pieter de Goeje References: <496E117D.8030306@itlegion.ru> <200901141801.45996.pieter@degoeje.nl> In-Reply-To: <200901141801.45996.pieter@degoeje.nl> X-Enigmail-Version: 0.95.7 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Cc: Artem Kuchin , freebsd-questions@freebsd.org Subject: Re: Blocking very many (tens of thousands) ip addresses in ipfw X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 14 Jan 2009 17:13:16 -0000 Pieter de Goeje wrote: > On Wednesday 14 January 2009 17:23:25 Artem Kuchin wrote: >> I need to block around 150000 ip addreses from acccess the server at all >> at any port. The addesses are random, they are not nets. >> These are the spammer i want to block for 24 hours. >> The list is dynamically generated and regenerated every hour or so. >> What is the most efficient way to do it? >> At first i thought doing ipfw rules using 5 ips per rule, that would >> result in 30000 rules! This will be too slow! >> I need to something really quick and smart. Like matching the first >> number from ip (195 from 192.1.2.3), >> if it does not match - skip, if it does - compare the next one >> and so on. > > Quoting ipfw(8): > LOOKUP TABLES > Lookup tables are useful to handle large sparse address sets, typically > from a hundred to several thousands of entries. There may be up to 128 > different lookup tables, numbered 0 to 127. > > net.inet.ip.fw.dyn_buckets should probably also be increased to efficiently > handle 150k IPs. Please correct me if I'm wrong, but if the OP is going to drop all traffic immediately from the 150k IPs, then dyn_buckets shouldn't come into play, as there is no dynamic rule generated. Steve