Re: ipfw rules vs routes to localhost?

From: Neelkanth Natu (neelnatu_at_yahoo.com)
Date: 05/30/03

  • Next message: Dennis Pedersen: "Re: Spontan reboot of FreeBSD 4,x box" 
    Date: Thu, 29 May 2003 18:12:49 -0700 (PDT)
To: "."@babolo.ru, Paul Chvostek <paul@it.ca>

    --- .@babolo.ru wrote:
    > > I'm considering:
    > >
    > > ipfw add N deny ip from a.b.c.d to any
    > >
    > > vs.
    > >
    > > route add -host a.b.c.d localhost
    > >
    > > I need to block traffic to a number of IP addresses. I thought I'd use
    > > ipfw to avoid things like UDP DNS lookups that might come in ant take up
    > > resources while my system tried to respond, but it's been suggested on
    > > another list that setting routes to localhost will use less resources.
    > > Ideally, I'd like to be able to block a few tens of thousands of IPs.
    > >
    > > What's the scoop?
    > ipfw with huge list works slow.
    > Dont try huge route tables.
    >
    > use in kernel:
    > pseudo-device disc #Discard device (ds0, ds1, etc)
    >
    > and
    > ifconfig ds0 inet 0.0.0.1/32 (or else)
    > route add -host a.b.c.d 0.0.0.1
    > instead of localhost

    An advantage of using "disc" is that you can monitor interface
    counters and use tcpdump to see the discarded traffic. A blackhole
    route to the loopback interface does not offer you this luxury.

    best
    Neel

    __________________________________
    Do you Yahoo!?
    Yahoo! Calendar - Free online calendar with sync to Outlook(TM).
    http://calendar.yahoo.com
    _______________________________________________
    freebsd-net@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-net
    To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org"

  • Next message: Dennis Pedersen: "Re: Spontan reboot of FreeBSD 4,x box"

    Relevant Pages

    • Re: Packet flow through IPFW+IPF+IPNAT ?
      ... > Or, in other words, IPF always 'sees' the real IPs, not the NATed ... Is it also true for IPFW? ... Do you Yahoo!? ... Calendar - Free online calendar with sync to Outlook. ...
      (FreeBSD-Security)
    • Re: tricking myself w/ multihoming
      ... > The default route is also on rl1: ... > This setup lets outgoing SMTP transactions go out my public block. ... route to 198.175.254.1 rather than playing ipfw games. ...
      (freebsd-net)
    • Re: 2 adsl connections load balancing with natd/ipfw
      ... ipfw add prob 0.5 allow ip from any to any out via em1 fwd 192.168.2.1 ... a route to 192.168.2.1 via default route) ... and Client A and Client B are also FreeBSD ... >>>> paths from the ISP to you. ...
      (freebsd-isp)
    • ipfw rules vs routes to localhost?
      ... route add -host a.b.c.d localhost ... ipfw to avoid things like UDP DNS lookups that might come in ant take up ... another list that setting routes to localhost will use less resources. ...
      (freebsd-net)
    • Re: natd problem (but close!)
      ... >> The gateway can access the Internet just fine. ... >> trying a ping and a lynx from the client. ... > Do an ipfw list and you should see an entry at or very near the top similar ... Do you Yahoo!? ...
      (freebsd-questions)
    • Quantcast