Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm wondering how scalable it is to add IP addresses or subranges I want to block into ufw. E.g., I do this whenever I discover a particularly bad bot or server farm. As my list grows, I wonder how much overhead I'm placing on the system; because now every packet must be checked against this list.

Does anyone have experience with a block list of a certain size that began to cause system load, or network slowdowns?

Is there anything in the docs somewhere about this?

Right now I've got about 15 rules. Is there some number of rules I should stay below?

share|improve this question
up vote 7 down vote accepted

It's a whole lot less load than trying to service the traffic... large chains have an impact on performance, but with a bit of judicious optimisation (splitting out traffic into different chains) you can keep it under control.

For reference, I've got a 20k rule iptables firewall that performs quite adequately under a couple of hundred Mbps of traffic... I don't think you've got much to worry about with 15 rules.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.