Re: blacklist Max Size

Tom Eastep
2010-05-14T14:35:55Z

On 5/13/10 10:43 PM, Jason Wallace wrote:

>
> I''d like to load a blacklist of just under 7000 entries.  Can
anyone
> (with real world experience, maybe) tell me if this is sane?
> Will it work, or will there be a big performance hit?  What IS an
> agreeable number of entries in the blacklist file?

I personally consider anything over 50 to be insane. Remember that every
connection entering your firewall on a ''blacklist'' interface
has to
traverse *every* blacklisting rule before it is accepted. Use ipsets.

-Tom
--
Tom Eastep        \ When I die, I want to go like my Grandfather who
Shoreline,         \ died peacefully in his sleep. Not screaming like
Washington, USA     \ all of the passengers in his car
http://shorewall.net \________________________________________________



------------------------------------------------------------------------------