>Hi, all Hi, >i'd like to know how many rule can manage iptable. >I'm asking that because i'd to drop all traffric from my localnet to >porn site. I've a database of porn site witch contain about 900 000 >domains. I know there are solutions like squidguard. But for my linux >box i'd to use iptable to prevent users access to porn site and other >blacklist site. It's not feasible to implement 900 000 long ruleset in iptables even with ipset extension or with fancy hierarchical chains. The other problem is that iptables works on ip addresses and your database is comprised of domains. There can be more then one site on single ip address. Blocking IPs and not domains could cut access to some legit sites. Squid+squidguard is good option. I've heard of some dns based solutions (domain blacklisting on dnscache level), but I don't know any actual software. Best regards, Marek -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
