I have an OpenBSD 5.1 box that is running a static html based website.

I have a list of IP addresses that I want to allow, ex.:


It's a ~10 KByte. ~10 000 lines. I only want to allow these IP addresses, not else to contact the server (httpd, ssh, anything, even ports that aren't used).

Q: What is the best syntax to do this in the host.allow/host.deny file? (AFAIK it should be better to put 10 000 IP address ranges in a file then puting them in the firewall..)

  • Are enough of these addresses/nets contiguous to consolidate them? For example, and = – depquid Mar 21 '13 at 16:38
  • 1
    Just for my own curiosity, what are your issues with putting the rules into the firewall? – Bratchley Jul 1 '13 at 12:42

With OpenBSD's implementation of tcpwrappers, I think you need to include each of your addresses in /etc/hosts.allow, which, with 10k entries, will very soon get very unwieldy.

ALL : ... ... : deny

It won't take many lines before this becomes a nightmare to manage. Note that addresses are separated with spaces or commas, or both.

If you have pf configured and running, you might find it easier to populate a table from the contents of your address file:

table <blockthese> persist file /etc/list-of-addresses-to-block

block in log quick on $ext_if from <blockthese> to any

Lookups against tables in pf are quick, and tables are pretty efficient in terms of memory use, so unless you have really limited amounts of RAM on an old machine, this should work just fine - it's a strategy I use on numerous FreeBSD hosts, and it works very well.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.