ipfw rules vs routes to localhost?

[Crist J. Clark]

On Wed, May 28, 2003 at 05:40:46PM -0400, Barney Wolff wrote:
> On Wed, May 28, 2003 at 02:03:59PM -0700, Crist J. Clark wrote:
> > On Wed, May 28, 2003 at 12:51:54AM -0400, Paul Chvostek wrote:
> > > 
> > > I'm considering:
> > > 
> > >   ipfw add N deny ip from a.b.c.d to any
> > > 
> > > vs.
> > > 
> > >   route add -host a.b.c.d localhost
> > > 
> > > I need to block traffic to a number of IP addresses.  I thought I'd use
> > > ipfw to avoid things like UDP DNS lookups that might come in ant take up
> > > resources while my system tried to respond, but it's been suggested on
> > > another list that setting routes to localhost will use less resources.
> > > Ideally, I'd like to be able to block a few tens of thousands of IPs.
> > > 
> > > What's the scoop?
> > 
> > Someone is assumng the old rule for blocking traffic on a (Cisco)
> > router applies to the FreeBSD stack. It doesn't necessarily apply.
> > 
> > First off, blocking it in ipfw rules is obviously more efficient if
> > you are running ipfw(8) already.
> 
> Can ipfw really handle "tens of thousands" of rules efficiently?

If we're talking about tens of thousands of hosts sparsely distributed
through IP-space, I don't think either approach is very practical.

> If I had to do this inbound, I'd look at netgraph as a way to put
> custom code in the kernel that looks up the source IP addr in a
> hash table.

Writing something that uses pfil(9) might also be a lightweight way to
do this.
-- 
Crist J. Clark                     |     cjclark at alum.mit.edu
                                   |     cjclark at jhu.edu
http://people.freebsd.org/~cjc/    |     cjc at freebsd.org