How to block 200K ip addresses?

[Dan Nelson]

In the last episode (Aug 26), Aminuddin said:
> How do you block this large range of ip addresses from different
> subnet? IPFW only allows 65536 rules while this will probably use up
> a few hundred thousands of lines.
> 
> I'm also trying to add this into my proxy configuration file, ss5.conf but
> it doesn't allow me to add this large number.
> 
> IS this the limitation of IPF or FreeBSD? How do I work around this?

Even though there are 65536 rule numbers, each number can actually have
any amount of rules assigned to it.  What you're probably looking for,
though, is ipfw's table keyword, which uses the same radix tree lookup
format as the kernel's routing tables, so it scales well to large
amounts of sparse addresses.  man ipfw, search for "lookup tables".

-- 
	Dan Nelson
	dnelson at allantgroup.com