Re: Best way to block a long list of IPs?

On Tue, Jun 20, 2006 at 10:57:30PM +0200, Phil Regnauld wrote:
Brett Glass (brett) writes:

I've got an application in which I must block incoming TCP
connections to a FreeBSD server from a potentially large list of IP
addresses. Using IPFW is not a very efficient way to accomplish
this, because it must do a linear search of a list (either one
address per rule or an "or" list in a rule) and this could slow
down every packet entering the machine dramatically.

pf tables are VERY efficient -- man pf.conf

there are efficient tables in ipfw as well, which Ruslan implemented
some time ago -- yet another reason we should be grateful to him

http://people.freebsd.org/~ru/help/en/

and also, if your address are in the same /24 subnet, you can use
the ipfw address set format which looks like this
1.2.3.0/24{10,20,21,30,34,55}
and can deal in constant time for up to 256 randomly distributed hosts.
man ipfw has all the details.

cheers
luigi

_______________________________________________
freebsd-net@xxxxxxxxxxx mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "freebsd-net-unsubscribe@xxxxxxxxxxx"
_______________________________________________
freebsd-net@xxxxxxxxxxx mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "freebsd-net-unsubscribe@xxxxxxxxxxx"

Relevant Pages

  • Re: ipfw question
    ... # Pass and log all incoming ftp-data connections. ... ipfw add allow log tcp from any 20 to any in setup keep-state ... This way only the packets related to one of the states will pass ...
    (freebsd-questions)
  • Re: Unexpected keep state behaviour in ipfw
    ... > ipfw keep-state behaviour. ... In particular, the TCP state information ... > for connections through the firewall appears to be being lost so that ... > 11000 allow tcp from me to any out xmit ed1 keep-state ...
    (FreeBSD-Security)
  • Re: IpFilter / IpFireWall
    ... except for ones which are related in connections that were established as ... some badly configured servers test for ident (port ... See the security section in the FreeBSD handbook, ... compiling your kernel, and the ipfw manpage, for more details. ...
    (FreeBSD-Security)
  • RE: continued IPFW issues... (actually a lack of ability on my part)
    ... > I'm still having some sort of issues with ipfw rules on my server. ... When a connection is made to port 80 from an external host, ... host for the given action (inbound connections to port 80 in this case). ...
    (freebsd-questions)
  • FW: monitor ALL connections to ALL ports
    ... ipfw add count log all from any to any ... I want to log all connections, ... >> server it should log what ip accessed it, the time, which ip (web server ... >> runs on 2 external ip address) and the port. ...
    (FreeBSD-Security)