Currently I am employing a large number of ipsets (about 30k+ subnets in
total) which hold IP subnets fetched from whatever the latest version of
the geoip database I have sourced and compiled.
I am aware that xtables also have the geoip target, though was wandering
what the performance is like compared to having the same IP subnets
loaded with ipset. Has anyone tested/compared these two matching methods?
I know the performance of iptables when it deals with large number of ip
addresses is absolutely abysmal, so never tried to use the geoip target,
so just wanted to see if that has changed?
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
