Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.networking > #3648

Re: Too many IPTables rules?

Show all headers | View raw

On 2016-01-15, Doug Weiman <no@nyet.net> wrote:
> 	I have been adding IPTables rules to my system over time. The 
> rules are there mostly to reject connection attempts from IP addresses 
> that seem to be up to no good - repeated (but not necessarily every 
> minute) connection attempts to ports 22, 25, 53, etc. from IP addresses 
> that have no business doing so.
>
> 	I currently have a couple of hundred of such rules, and my system 
> seems to be coping without any perceptible sluggishness. I just wonder 
> though, for how much longer? This is an ordinary PC, not even a recent 
> one, at that. My guess is that I may be able to add another couple of 
> hundred such rules without any problems, but I would like to know if 
> there is a better way to achieve my goal - i.e. closing the door (maybe 
> temporarily) on such pests, while using the system's resources more 
> efficiently.

Yes, Use ipset. I do not know how you are running your firewall but with
shorewall, you can define a zone which uses ipset which creates a hash
of a bunch of addresses (thus seraching it very fast) and a timeout
after which the address is erased I set mine to a few weeks, but you
could make it 10 years if you wanted to. 


>
> 	I am aware of IPTables-based techniques to limit the rate of 
> incoming connections from specific IP addresses, but that may not work so 
> well here for, in many cases, we are talking one or two connections per 
> day, or even less. I mean, I don't think I can rely on a purely automatic 
> approach - I would like to make the decision myself as to what addresses 
> to block.
>
> 	Any suggestions?
>

Back to comp.os.linux.networking | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Too many IPTables rules? Doug Weiman <no@nyet.net> - 2016-01-15 16:31 +0000
  Re: Too many IPTables rules? William Unruh <unruh@invalid.ca> - 2016-01-15 17:06 +0000
  Re: Too many IPTables rules? RemziAKYUZ <linuxliste@gmail.com> - 2016-01-15 22:33 -0800
  Re: Too many IPTables rules? Doug Weiman <no@nyet.net> - 2016-01-16 19:24 +0000

csiph-web