I'd like to know if long chains in iptables is likely to cause a performance issue. Here a long chain might be >2,500 individual IP bans.

My concern is that my limited knowledge of iptables suggests this will result in 2,500 rules being checked for every packet the server receives.

My use case is this:

I'm using iptables to block IPs repeatedly poking my server in ways they shouldn't (eg repeated failed SSH logins). I'm using a python script similar to fail2ban.

More recently these "attacks" have begun to be smarter by slowing the attack down. I suspect they have inverted the nested loop of IP/username to username/IP. So to combat this I've had to massively extend the ban time. I take a pretty robust attitude to this so my new ban time is 1 year or double if they try again during a two month probation.

I've found anecdotal evidence for this type of banning to result in approximately 2,500 bans. If I took the rate of new bans currently it would be more like 8,000 but I'm hopeful that this rate will slow as the server begins to more accurately block malicious traffic.

  • You could split incoming connections into /5 subnets, effectively splitting the whole IPv4 address space into 32. Then make 32 chains (one for each subnet) where you check the blacklisted IP addresses for that subnet, so on average instead of 2500 checks for every packet, you have about 80 checks. – wurtel Apr 26 '19 at 11:27

A total of 2500 rules would be a big effort for the CPU/bandwidth in case of affecting each package. If, for example, you send 10000 packages you would be analyzing 25.000.000 rules, that would suppose a lot of work. It would be a lot of more accurate and secure to block all the incoming traffic (except the established and the related), and then start opening the services that will need make NEW connections to your side.

In case of wanting to add an IP blacklist you can use ipset that can create those kind of lists in a single rule and also update rules without supposing a big penalty for your performance. For example if you are blocking 2200 individual IPs, you can store them in a a list and check them from a single rule, that would suppose a lot of less effort in terms of CPU.

| improve this answer | |
  • Thanks I think ipset is what I was after. Yes the server is already setup to allow only specified services. – Philip Couling Apr 26 '19 at 22:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.