Tom Eastep wrote:> Denis Croombs wrote:
> > I want to blacklist ALL ip''s except approx 500, what is the
best way
> of doing
> > this ?
>
> Install someone else''s firewall product.
>
Seriously, there is no _good_ way to do that with Shorewall so any way
that you come up with will be equally horrible.
The exception would be if the 500 IP addresses are nicely grouped into a
few neat subnetworks. In that case, you can simply define your
''net''
zone using the hosts file and restrict the zone membership to those
subnets. That approach is not quite the same as blacklisting since
blacklisting checks every packet against the blacklist whereas the using
the hosts file will only check NEW packets.
If the 500 IP addresses are randomly distributed, each packet (or NEW
packet) will have to run a gauntlet averaging 250 rules. That really sucks.
There is an iptables-like facility available for Linux (I forget the
name) that may do a better job of this that iptables does since it
doesn''t rely on sequentially-evaluated rules. To my knowledge, no one
has hacked Shorewall to try to use the thing though...
-Tom
--
Tom Eastep \ Shorewall - iptables made easy
Shoreline, \ http://www.shorewall.net
Washington USA \ teastep@shorewall.net