On 05.03.2010 17:17, netfilter-owner@xxxxxxxxxxxxxxx wrote: > Hi, > I'm wondering what the most efficient way to implement a blocklist is. > We are basically talking about blocking a few thousand IPs. Does > iptables do some internal optimizations when blocking based on a source > address or would it be better to, say, create a chain for each class A > net (e.g. 83.0.0.0/8) and then add the IPs in that range to that class > to make the matching more efficient? > > Regards, > Dennis things i would take into consideration: - drop in raw table (avoid conntrack) - use user-defined chains - use ipset to match many IPs best regards Mart -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
