Re: Issue with Huge IP blocklist ?
Carlos Rodrigues <[email protected]>
| Newsgroups | gmane.comp.security.firewalls.firehol.user |
|---|---|
| Message-ID | <[email protected]> |
On Wed, Jun 17, 2009 at 9:26 PM, Carlos Rodrigues<[email protected]> wrote: > Well, > > You are effectively creating a single command with the total length of > those 300.000 lines. The runtime errors are probably just bash hitting > it's limits, and not exactly a problem with FireHOL itself. > > You can try putting something like the following inside your interface > statement: > > cat BADNETS | while IP; do > server all reject src $IP > done > > Although I'm not sure exactly how the rules generated by that would > compare with the ones generated from the interface statement itself. > > You can also try mixing in some iptables commands. For example, by > putting something like this in your firehol.conf: > > iptables -N my_blocklist > cat BADNETS | while IP; do > iptables -A -s $IP -j DROP That's "iptables -A my_blocklist -s $IP -j DROP", sorry. > done > > iptables -I 1 INPUT -i eth0 -j my_blocklist > > > Regards, > > > On Thu, Jun 11, 2009 at 8:01 AM, shi ryu<[email protected]> wrote: >> Hi guys, >> >> I'm trying to use firehol to process some bluetack IP blocklist and I fear >> that firehol cannot handle the size of the list. >> Here is how I proceed : >> >> 1) I've put in CIDR format all the subnets I'd like to filter on (1 per >> line) in the BADNETS file. >> 2) I've modified the firehol.conf following line from >> >> interface eth0 internet src not "${UNROUTABLE_IPS}" >> >> to >> >> interface eth0 internet src not "${UNROUTABLE_IPS} `cat >> /etc/firehol/BADNETS`" >> >> What happens : >> >> It seems that as long as my BADNETS file keeps a reasonable size, firehol is >> able to process it (see the attached BADNETS.light file with its 17925 >> lines)....indeed with BADNETS.light file no problem, firehol starts without >> errors. >> But when I load the BADNETS.full file (see the attached BADNETS.full.zip >> file with its 344396 lines) , then I get many runtime errors. >> >> I've attached the error.log.zip file which is an extract of the bunch of >> errors I get + the std output. >> >> Any help appreciated. >> >> Best Regards, >> Shiryu >> >> ------------------------------------------------------------------------------ >> Crystal Reports - New Free Runtime and 30 Day Trial >> Check out the new simplified licensing option that enables unlimited >> royalty-free distribution of the report engine for externally facing >> server and web deployment. >> http://p.sf.net/sfu/businessobjects >> _______________________________________________ >> Firehol-support mailing list >> [email protected] >> https://lists.sourceforge.net/lists/listinfo/firehol-support >> >> > > > > -- > Carlos Rodrigues > -- Carlos Rodrigues ------------------------------------------------------------------------------ Crystal Reports - New Free Runtime and 30 Day Trial Check out the new simplified licensing option that enables unlimited royalty-free distribution of the report engine for externally facing server and web deployment. http://p.sf.net/sfu/businessobjects