Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

It's easy to block IPs from country using iptables (e.g. like http://www.cyberciti.biz/faq/block-entier-country-using-iptables/). However I read that the performance can go down if the deny list get too large. An alternative is installing the iptables geoip patch or using ipset ( http://www.jsimmons.co.uk/2010/06/08/using-ipset-with-iptables-in-ubuntu-lts-1004-to-block-large-ip-ranges/) instead of iptables.

Does anyone have experience with the various approaches and can say something about the performance differences ?

Are there are other ways to block country IPs in linux which I did't mentioned above?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

I have been using geoip with ipset. i would recommend to use it as it had very low impact on performance on my network. if you use iptables alone, then surely the longer the rule set becomes, the delay for packet traversal will be higher.

IpSet actually matches GROUP of IPs, and the match is done in one swoop, instead of matching each rule for each bock of ips in iptable chains.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.