I'd like to know if long chains in iptables is likely to cause a performance issue. Here a long chain might be >2,500 individual IP bans.
My concern is that my limited knowledge of iptables suggests this will result in 2,500 rules being checked for every packet the server receives.
My use case is this:
I'm using iptables to block IPs repeatedly poking my server in ways they shouldn't (eg repeated failed SSH logins). I'm using a python script similar to fail2ban.
More recently these "attacks" have begun to be smarter by slowing the attack down. I suspect they have inverted the nested loop of IP/username to username/IP. So to combat this I've had to massively extend the ban time. I take a pretty robust attitude to this so my new ban time is 1 year or double if they try again during a two month probation.
I've found anecdotal evidence for this type of banning to result in approximately 2,500 bans. If I took the rate of new bans currently it would be more like 8,000 but I'm hopeful that this rate will slow as the server begins to more accurately block malicious traffic.