[no subject]

I was just thinking that a nice addition to iptables would be the
ability to pull in an external file of address:ports to allow/block.
Something like:

iptables -I INPUT -s @fileofbadpeopleips -j DROP

and have it resolve that file into a single rule with multiple matches.
A big OR list of addresses.


Hmm. Time to write Rusty.

While I'm at it, I'll put in the request for a -name flag. Having rules
(some at least) named make modifying that one rule easier. 
<run script to update bozo list from apache log>
iptables -D INPUT -name "bozo web list"
iptables -I INPUT -name "bozo web list" -s @bozoweblist -j DROP

Of course, I would also like to see a new target: -j FLOG
It sends the IP address to a userspace app that finds the lat/long of
the moron and sends in a small mob of drunken sailors with an attitude
problem...

> 
> 
> > Ram is the only limit I have seen in the kernel specs on it. For most
> > modern systems that are mostly dedicated to firewalling, the wire speed
> > will always be the limiting factor. The iptables process (barring
> > strange loops that are VERY BAD) is a quite streamlined, multi-threaded
> > process. I do know that performance can suffer if rule ordering is poor
> > and every packet is forced through every table. I get pretty good
> > results with a table for each protocol/port that is allowed that nees
> > further filtering to block out bozo's (morons doing ssh scans should get
> > blocked on all ports as they are up to no good)
> 
> Thanks,
> 
> -Jim P.
> 
> 
> 
> _______________________________________________
> Ale mailing list
> Ale at ale.org
&gt; <a  rel="nofollow" href="http://www.ale.org/mailman/listinfo/ale";>http://www.ale.org/mailman/listinfo/ale</a>
-- 
James P. Kinney III          \Changing the mobile computing world/
CEO &amp; Director of Engineering \          one Linux user         /
Local Net Solutions,LLC        \           at a time.          /
770-493-8244                    \.___________________________./
<a  rel="nofollow" href="http://www.localnetsolutions.com";>http://www.localnetsolutions.com</a>

GPG ID: 829C6CA7 James P. Kinney III (M.S. Physics)
&lt;jkinney at localnetsolutions.com&gt;
Fingerprint = 3C9E 6366 54FC A3FE BA4D 0659 6190 ADC3 829C 6CA7
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part



</pre>
<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->
<hr>
<!--X-Follow-Ups-End-->
<!--X-References-->
<ul><li><strong>References</strong>:
<ul>
<li><strong><a name="00104" href="msg00104.html">[ale] iptables limits?</a></strong>
<ul><li><em>From:</em> jimpop at yahoo.com (Jim Popovitch)</li></ul></li>
<li><strong><a name="00114" href="msg00114.html">[ale] iptables limits?</a></strong>
<ul><li><em>From:</em> jkinney at localnetsolutions.com (James P. Kinney III)</li></ul></li>
<li><strong><a name="00116" href="msg00116.html">[ale] iptables limits?</a></strong>
<ul><li><em>From:</em> jimpop at yahoo.com (Jim Popovitch)</li></ul></li>
</ul></li></ul>
<!--X-References-End-->
<!--X-BotPNI-->
<ul>
<li>Prev by Date:
<strong><a href="msg00128.html">[ale] Debian 3.0 as a server platform?</a></strong>
</li>
<li>Next by Date:
<strong><a href="msg00130.html">[ale] Debian 3.0 as a server platform?</a></strong>
</li>
<li>Previous by thread:
<strong><a href="msg00116.html">[ale] iptables limits?</a></strong>
</li>
<li>Next by thread:
<strong><a href="msg00117.html">[ale] iptables limits?</a></strong>
</li>
<li>Index(es):
<ul>
<li><a href="maillist.html#00129"><strong>Date</strong></a></li>
<li><a href="threads.html#00129"><strong>Thread</strong></a></li>
</ul>
</li>
</ul>

<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->
</body>
</html>