Reputation
Top tag
Next privilege 200 Rep.
See reduced ads
Badges
9
Impact
~2k people reached

  • 0 posts edited
  • 0 helpful flags
  • 1 vote cast
Mar
31
comment Can't add large number of rules to iptables
I was blocking china because of bruteforce ssh login attempts--so haproxy nor nginx would have helped. Also recompiling the kernel was not an option as I did not have control over it on my vps. Hence why I was unable to use ipset in the first place. For what it is worth, the provider I was using was MediaTemple which still has not moved away from virtuozzo.
Mar
30
comment Can't add large number of rules to iptables
If you read my answer, in this particular instance ipset was not an option. If it was, I would have used it. I have since switched VPS providers and use ipset now.
Dec
30
awarded  Popular Question
Sep
24
awarded  Autobiographer
Oct
4
awarded  Revival
Oct
4
comment Can't add large number of rules to iptables
Thanks @derobert, I did mention that in my answer.
Feb
28
awarded  Critic
Feb
28
awarded  Supporter
Jan
29
comment Can't add large number of rules to iptables
Does that work on CentOS 5.x without recompiling the kernel?
Jan
29
awarded  Teacher
Jan
29
awarded  Scholar
Jan
29
accepted Can't add large number of rules to iptables
Jan
29
answered Can't add large number of rules to iptables
Nov
5
awarded  Editor
Nov
5
revised Can't add large number of rules to iptables
added 484 characters in body
Nov
5
comment Can't add large number of rules to iptables
That's what I did. Like I said, it was a very simple bash script; I had ~7300 lines that looked just like the example I gave. All the iptables commands after ~400 give the same "unknown error". I ran service iptables save before executing the script, so it was simple to revert using service iptables restart. If it's a bug in CentOS' kernel config, I'm not sure there's much I can do about that given that it's a virtual dedicated server (can't do kernel modifications, afaik).
Nov
5
comment Can't add large number of rules to iptables
I use sshguard (www.sshguard.net) to block attacks dynamically. I looked into fail2ban and denyhosts, but those would be redundant with sshguard running. That said, the main issue is that I want to block these IP ranges preemptively, because of crawlers and scrapers in those regions.
Nov
5
awarded  Student
Nov
5
asked Can't add large number of rules to iptables