Date: Wed, 28 May 2003 15:28:52 -0700 From: "Crist J. Clark" <crist.clark@attbi.com> To: Barney Wolff <barney@databus.com> Cc: freebsd-net@freebsd.org Subject: Re: ipfw rules vs routes to localhost? Message-ID: <20030528222852.GD3907@blossom.cjclark.org> In-Reply-To: <20030528214046.GA9084@pit.databus.com> References: <20030528045154.GA95572@mail.it.ca> <20030528210359.GA3907@blossom.cjclark.org> <20030528214046.GA9084@pit.databus.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, May 28, 2003 at 05:40:46PM -0400, Barney Wolff wrote:
> On Wed, May 28, 2003 at 02:03:59PM -0700, Crist J. Clark wrote:
> > On Wed, May 28, 2003 at 12:51:54AM -0400, Paul Chvostek wrote:
> > >
> > > I'm considering:
> > >
> > > ipfw add N deny ip from a.b.c.d to any
> > >
> > > vs.
> > >
> > > route add -host a.b.c.d localhost
> > >
> > > I need to block traffic to a number of IP addresses. I thought I'd use
> > > ipfw to avoid things like UDP DNS lookups that might come in ant take up
> > > resources while my system tried to respond, but it's been suggested on
> > > another list that setting routes to localhost will use less resources.
> > > Ideally, I'd like to be able to block a few tens of thousands of IPs.
> > >
> > > What's the scoop?
> >
> > Someone is assumng the old rule for blocking traffic on a (Cisco)
> > router applies to the FreeBSD stack. It doesn't necessarily apply.
> >
> > First off, blocking it in ipfw rules is obviously more efficient if
> > you are running ipfw(8) already.
>
> Can ipfw really handle "tens of thousands" of rules efficiently?
If we're talking about tens of thousands of hosts sparsely distributed
through IP-space, I don't think either approach is very practical.
> If I had to do this inbound, I'd look at netgraph as a way to put
> custom code in the kernel that looks up the source IP addr in a
> hash table.
Writing something that uses pfil(9) might also be a lightweight way to
do this.
--
Crist J. Clark | cjclark@alum.mit.edu
| cjclark@jhu.edu
http://people.freebsd.org/~cjc/ | cjc@freebsd.org
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20030528222852.GD3907>