From owner-freebsd-net@FreeBSD.ORG  Tue Jun 20 21:07:36 2006
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
X-Original-To: net@freebsd.org
Delivered-To: freebsd-net@FreeBSD.ORG
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 88D9616A47A
	for <net@freebsd.org>; Tue, 20 Jun 2006 21:07:36 +0000 (UTC)
	(envelope-from rizzo@icir.org)
Received: from xorpc.icir.org (xorpc.icir.org [192.150.187.68])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 2639043D6B
	for <net@freebsd.org>; Tue, 20 Jun 2006 21:07:36 +0000 (GMT)
	(envelope-from rizzo@icir.org)
Received: from xorpc.icir.org (localhost [127.0.0.1])
	by xorpc.icir.org (8.12.11/8.12.11) with ESMTP id k5KL7NJV001245;
	Tue, 20 Jun 2006 14:07:23 -0700 (PDT)
	(envelope-from rizzo@xorpc.icir.org)
Received: (from rizzo@localhost)
	by xorpc.icir.org (8.12.11/8.12.3/Submit) id k5KL7M0W001244;
	Tue, 20 Jun 2006 14:07:22 -0700 (PDT) (envelope-from rizzo)
Date: Tue, 20 Jun 2006 14:07:22 -0700
From: Luigi Rizzo <rizzo@icir.org>
To: Brett Glass <brett@lariat.org>, net@freebsd.org,
	Phil Regnauld <regnauld@catpipe.net>
Message-ID: <20060620140722.A1192@xorpc.icir.org>
References: <7.0.1.0.2.20060620143845.06662330@lariat.org>
	<20060620205730.GC3968@catpipe.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2.5.1i
In-Reply-To: <20060620205730.GC3968@catpipe.net>;
	from regnauld@catpipe.net on Tue, Jun 20, 2006 at 10:57:30PM +0200
Cc: 
Subject: Re: Best way to block a long list of IPs?
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 20 Jun 2006 21:07:36 -0000

On Tue, Jun 20, 2006 at 10:57:30PM +0200, Phil Regnauld wrote:
> Brett Glass (brett) writes:
> > 
> > I've got an application in which I must block incoming TCP 
> > connections to a FreeBSD server from a potentially large list of IP 
> > addresses. Using IPFW is not a very efficient way to accomplish 
> > this, because it must do a linear search of a list (either one 
> > address per rule or an "or" list in a rule) and this could slow 
> > down every packet entering the machine dramatically.
> 
> 	pf tables are VERY efficient -- man pf.conf

there are efficient tables in ipfw as well, which Ruslan implemented
some time ago -- yet another reason we should be grateful to him

	http://people.freebsd.org/~ru/help/en/

and also, if your address are in the same /24 subnet, you can use
the ipfw address set format which looks like this
	 1.2.3.0/24{10,20,21,30,34,55}
and can deal in constant time for up to 256 randomly distributed hosts.
man ipfw has all the details.

	cheers
	luigi

> _______________________________________________
> freebsd-net@freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-net
> To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org"