Hi, Le jeudi 17 septembre 2009 à 21:15 +0200, Mikulas Patocka a écrit : > Hi > > Here I submit an iptables module that can match large amounts (millions) > of ip addresses efficiently using binary search. What are the differences with ipset ? (http://ipset.netfilter.org/) BR, > I needed it to protect my > home network from spam. It may be useful for other people too, so if you > want it, you can take it and add it to the kernel. > > Get the patches for netfilter and kernel at: > http://artax.karlin.mff.cuni.cz/~mikulas/xt_ipfile/ > (you need to copy the file include/linux/netfilter/xt_ipfile.h from kernel > sources to /usr/include/linux/netfilter/ to compile the userspace) > > The main features: > - fast matching of large amount of ip addresses using binary search. > - an ability to match ranges of addresses or address/mask subnets. > - fast loading of the addresses (on Pentium 3 850, 2 million addresses > load in 5.5s, if they are already sorted in the file, the load time is > just 1.5s). > - memory efficient --- consumes only 8 bytes per address. > > USAGE: > > prepare a file with addreses, in this example /root/firewall/bad-ips. One > entry per line, the allowed formats are: > 1.2.3.4 > 1.2.3.0/24 > 1.2.3.4-1.2.3.8 > > insert it into iptables with: > iptables -A SPAM -m ipfile --src-file /root/firewall/bad-ips -j DROP > > The module doesn't support ipv6 because I don't use it, but it's generic > enough that it could be extended for it. It could be also extended to > match ethernet MAC addresses. > > Mikulas > -- > To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in > the body of a message to majordomo@xxxxxxxxxxxxxxx > More majordomo info at http://vger.kernel.org/majordomo-info.html -- Eric Leblond <eric@xxxxxx> INL: http://www.inl.fr/ NuFW: http://www.nufw.org/
Attachment:
signature.asc
Description: Ceci est une partie de message =?ISO-8859-1?Q?num=E9riquement?= =?ISO-8859-1?Q?_sign=E9e?=
