Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have an OpenBSD 5.1 box that is running a static html based website.

I have a list of IP addresses that I want to allow, ex.:

...
78.128.49.0/24
78.128.50.0/24
...

It's a ~10 KByte. ~10 000 lines. I only want to allow these IP addresses, not else to contact the server (httpd, ssh, anything, even ports that aren't used).

Q: What is the best syntax to do this in the host.allow/host.deny file? (AFAIK it should be better to put 10 000 IP address ranges in a file then puting them in the firewall..)

share|improve this question
    
Are enough of these addresses/nets contiguous to consolidate them? For example, 78.128.50.0/24 and 78.128.51.0/24 = 78.128.50.0/23 –  depquid Mar 21 '13 at 16:38
    
Just for my own curiosity, what are your issues with putting the rules into the firewall? –  Joel Davis Jul 1 '13 at 12:42
add comment

1 Answer 1

up vote 0 down vote accepted

With OpenBSD's implementation of tcpwrappers, I think you need to include each of your addresses in /etc/hosts.allow, which, with 10k entries, will very soon get very unwieldy.

ALL : ... 78.128.49.0/24 78.128.50.0/24 ... : deny

It won't take many lines before this becomes a nightmare to manage. Note that addresses are separated with spaces or commas, or both.

If you have pf configured and running, you might find it easier to populate a table from the contents of your address file:

table <blockthese> persist file /etc/list-of-addresses-to-block

block in log quick on $ext_if from <blockthese> to any

Lookups against tables in pf are quick, and tables are pretty efficient in terms of memory use, so unless you have really limited amounts of RAM on an old machine, this should work just fine - it's a strategy I use on numerous FreeBSD hosts, and it works very well.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.