Is faster iptables or mod_security when working with large blocklist?

postcd

If i regularly update an file containing approx. 100 000 IPs (and subnets?), and i won't use ipset, is it faster to block website visitor by:

1) somehow making IPtables to adopt this file while this file will be updated like hourly

2) adding file to the tmpfs (ramdrive) and setting up some mod_security rule to 403 all those whose IP match line/IP in the tmpfs based 100 000 lines file

?

If there is someone who can spend time, it would help (maybe not just me) to share on how to include regularly updated file into iptables or how to make mod security rule compare visitor IP to the localhost/URL based file. Thx

matteob

best is ipset

globalRegisters

Use iptables with ipset.

howardsl2

Refer to my IPSet tutorial at:
https://blog.ls20.com/securing-your-server-using-ipset-and-dynamic-blocklists/

Falzo

Sounds like he is using OVZ...

postcd

yes, i will not use ipset in this case, mod security with ram based big blocklist (if possible to use file based blocklist in its rule) will not be better than iptables?

Clouvider

No, as you're already on the application level. It's better, and safer, to drop the attackers at the edge of your server.

Fusl

Some of my recommended ways to block a large amount of IPs/networks

1. Use ipset with iptables raw table, or
   • iptables -t raw -I PREROUTING -i venet0 -p tcp --dport 80 -m set --match-set blocklist src -j DROP
2. Use iptables raw table, or
   • iptables -t raw -N blocklist
   • iptables -t raw -I PREROUTING -i venet0 -p tcp --dport 80 -j blocklist
   • for ip in x x x; do iptables -t raw -I blocklist -s $ip -j DROP; done
3. Null-route + route path filtering, or
   • Create a dummy0 network interface
   • Create a static /32 route for all blacklisted IP addresses to this dummy0 interface
   • Set the kernel parameter for route path filtering to 1
4. Use iptables filter table
   • iptables -N blocklist
   • iptables -I INPUT -i venet0 -p tcp --dport 80 -j blocklist
   • for ip in x x x; do iptables -I blocklist -s $ip -j DROP; done

All of the above ways to block an IP list still happens in the kernel level and are as such the most efficient ways of blocking IPs (sorted by efficiency).

postcd

@Fusl

thx, it would be nice to know what this mean

iptables -t raw -N blocklist

iptables -t raw -I PREROUTING -i venet0 -p tcp --dport 80 -j blocklist

the third command i assume is filling some blocklist with bad IPs, but where this bloclist reside and how to work with it (export, save)

Francisco

Neither is a good solution.

Apache will have to read that file and process it for every single visit. You could try putting something like nginx in front since that's just the initial startup.

// shill

Why not get a slice?

http://buyvm.net/kvm-dedicated-server-slices

Francisco