Re: how many IPFW rules?

In the last episode (Oct 30), eBoundHost: Artur said:
Hello FreeBSD people!

I have a smtp server under attack by what seems like a large botnet. My
inetd is choking under the load and not allowing real mail through. I've
successfully used tshark to find the offenders and put them into ipfw
firewall for port 25.

So here is my question, I'm currently blocking 55,529 ip addresses and the
server seems pretty snappy, with no noticible load or lag. How many more
rulesets will I be able to handle before things start getting fuzzy?

If you've created 55K separate rules and you're not seeing any
slowdown, then you must have a fast machine :) Using an ipfw table
should be even better, though. That lets you load any number of
ip/netmask pairs into a tree-based lookup table and match all addresses
using one ipfw rule. The ipfw manpage has examples.

--
Dan Nelson
dnelson@xxxxxxxxxxxxxxx
_______________________________________________
freebsd-questions@xxxxxxxxxxx mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscribe@xxxxxxxxxxx"

Relevant Pages

  • Re: how many IPFW rules?
    ... I'm not going to brag but this is one hell of a server :-) hardware prices were not a concern when we built it. ... inetd is choking under the load and not allowing real mail through. ... successfully used tshark to find the offenders and put them into ipfw ... If you've created 55K separate rules and you're not seeing any ...
    (freebsd-questions)
  • Re: Reject Unknown Users from SMTP
    ... If it is a VMS SMTP server, why shouldn't it immediately look up the ... such, but considering the current environment of spam, spam, spam, ... Less load on the SMTP server, ... are my mail queues filled with bouncing messages for nonexistant accounts ...
    (comp.os.vms)
  • Re: [PATCH] ng_tag - new netgraph node, please test (L7 filtering possibility)
    ... > I can't load the kld on my Sun Sparc, I think I messed up ld yesterday ... so exact tags representation can change each time ... (for this reason ipfw tags were made incompatible with pf), ... > I'm particularly interested in this for doing packed shaping, ...
    (freebsd-current)
  • Re: make buildkernel failed related to ip_divert module
    ... Then you can load everything as module. ... unless you want to use 'ipfw fwd'. ... interface and 192.168.10.1/24 on the other interface with a default ... That is the reason for the check. ...
    (freebsd-current)
  • Sunfire X2200 ipfw and bge issues
    ... We have a new Sunfire X2200 and when I load 6.2 stable on it ipfw will not load on boot. ... After the system boots I can do a kldload ipfw and get it working. ... This system is also rebooting every time I plug the ethernet cable into the bge0 port on the system. ...
    (freebsd-stable)