From owner-freebsd-net@FreeBSD.ORG Wed May 28 15:28:55 2003 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 52AD337B401 for ; Wed, 28 May 2003 15:28:55 -0700 (PDT) Received: from rwcrmhc53.attbi.com (rwcrmhc53.attbi.com [204.127.198.39]) by mx1.FreeBSD.org (Postfix) with ESMTP id 3B33D43F93 for ; Wed, 28 May 2003 15:28:54 -0700 (PDT) (envelope-from crist.clark@attbi.com) Received: from blossom.cjclark.org (12-234-159-107.client.attbi.com[12.234.159.107]) by attbi.com (rwcrmhc53) with ESMTP id <2003052822285305300qkapfe>; Wed, 28 May 2003 22:28:53 +0000 Received: from blossom.cjclark.org (localhost. [127.0.0.1]) by blossom.cjclark.org (8.12.8p1/8.12.3) with ESMTP id h4SMSrki004643; Wed, 28 May 2003 15:28:53 -0700 (PDT) (envelope-from crist.clark@attbi.com) Received: (from cjc@localhost) by blossom.cjclark.org (8.12.8p1/8.12.8/Submit) id h4SMSqlj004642; Wed, 28 May 2003 15:28:52 -0700 (PDT) X-Authentication-Warning: blossom.cjclark.org: cjc set sender to crist.clark@attbi.com using -f Date: Wed, 28 May 2003 15:28:52 -0700 From: "Crist J. Clark" To: Barney Wolff Message-ID: <20030528222852.GD3907@blossom.cjclark.org> References: <20030528045154.GA95572@mail.it.ca> <20030528210359.GA3907@blossom.cjclark.org> <20030528214046.GA9084@pit.databus.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20030528214046.GA9084@pit.databus.com> User-Agent: Mutt/1.4.1i X-URL: http://people.freebsd.org/~cjc/ cc: freebsd-net@freebsd.org Subject: Re: ipfw rules vs routes to localhost? X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: cjclark@alum.mit.edu List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 28 May 2003 22:28:55 -0000 On Wed, May 28, 2003 at 05:40:46PM -0400, Barney Wolff wrote: > On Wed, May 28, 2003 at 02:03:59PM -0700, Crist J. Clark wrote: > > On Wed, May 28, 2003 at 12:51:54AM -0400, Paul Chvostek wrote: > > > > > > I'm considering: > > > > > > ipfw add N deny ip from a.b.c.d to any > > > > > > vs. > > > > > > route add -host a.b.c.d localhost > > > > > > I need to block traffic to a number of IP addresses. I thought I'd use > > > ipfw to avoid things like UDP DNS lookups that might come in ant take up > > > resources while my system tried to respond, but it's been suggested on > > > another list that setting routes to localhost will use less resources. > > > Ideally, I'd like to be able to block a few tens of thousands of IPs. > > > > > > What's the scoop? > > > > Someone is assumng the old rule for blocking traffic on a (Cisco) > > router applies to the FreeBSD stack. It doesn't necessarily apply. > > > > First off, blocking it in ipfw rules is obviously more efficient if > > you are running ipfw(8) already. > > Can ipfw really handle "tens of thousands" of rules efficiently? If we're talking about tens of thousands of hosts sparsely distributed through IP-space, I don't think either approach is very practical. > If I had to do this inbound, I'd look at netgraph as a way to put > custom code in the kernel that looks up the source IP addr in a > hash table. Writing something that uses pfil(9) might also be a lightweight way to do this. -- Crist J. Clark | cjclark@alum.mit.edu | cjclark@jhu.edu http://people.freebsd.org/~cjc/ | cjc@freebsd.org