Messages in this thread | | | Date | Fri, 9 Jan 2009 07:46:59 +0100 | From | Willy Tarreau <> | Subject | Re: [ANNOUNCE] Kernel Blocking Firewall |
| |
On Thu, Jan 08, 2009 at 07:23:43PM -0700, jmerkey@wolfmountaingroup.com wrote: > iptables is just too cumbersome and memory comsumptive to work well and > has a shitty app inteface so I wrote one with a kernel level database and > combined it with postfix. This firewall actually drops packets on the > floor by port, or in their entirety by IP address to deal with these > jerks. > > The code is a kernel module that will build an RBL database to disk and it > will cache up to 500,000 IP addresses efficiently on a 1GB home personal > computer. The more memory you have, the more IP addresses you can cache. > It is configurable and possible to hold millions of them if you have 4GB > of memory in the server.
why didn't you use ipset for that ? It's designed exactly for this usage and is a lot easier to use than plain iptables for dynamic filtering.
Willy
| |