I have an OpenBSD 5.1 box that is running a static html based website.

I have a list of IP addresses that I want to allow, ex.:


It's a ~10 KByte. ~10 000 lines. I only want to allow these IP addresses, not else to contact the server (httpd, ssh, anything, even ports that aren't used).

Q: What is the best syntax to do this in the host.allow/host.deny file? (AFAIK it should be better to put 10 000 IP address ranges in a file then puting them in the firewall..)

  • Are enough of these addresses/nets contiguous to consolidate them? For example, and =
    – depquid
    Commented Mar 21, 2013 at 16:38
  • 1
    Just for my own curiosity, what are your issues with putting the rules into the firewall?
    – Bratchley
    Commented Jul 1, 2013 at 12:42

1 Answer 1


With OpenBSD's implementation of tcpwrappers, I think you need to include each of your addresses in /etc/hosts.allow, which, with 10k entries, will very soon get very unwieldy.

ALL : ... ... : deny

It won't take many lines before this becomes a nightmare to manage. Note that addresses are separated with spaces or commas, or both.

If you have pf configured and running, you might find it easier to populate a table from the contents of your address file:

table <blockthese> persist file /etc/list-of-addresses-to-block

block in log quick on $ext_if from <blockthese> to any

Lookups against tables in pf are quick, and tables are pretty efficient in terms of memory use, so unless you have really limited amounts of RAM on an old machine, this should work just fine - it's a strategy I use on numerous FreeBSD hosts, and it works very well.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .