On 5/13/10 10:43 PM, Jason Wallace wrote: > > I'd like to load a blacklist of just under 7000 entries. Can anyone > (with real world experience, maybe) tell me if this is sane? > Will it work, or will there be a big performance hit? What IS an > agreeable number of entries in the blacklist file?
I personally consider anything over 50 to be insane. Remember that every connection entering your firewall on a 'blacklist' interface has to traverse *every* blacklisting rule before it is accepted. Use ipsets. -Tom -- Tom Eastep \ When I die, I want to go like my Grandfather who Shoreline, \ died peacefully in his sleep. Not screaming like Washington, USA \ all of the passengers in his car http://shorewall.net \________________________________________________
signature.asc
Description: OpenPGP digital signature
------------------------------------------------------------------------------
_______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
