Block countries using iptables /netfilter

Question

It's easy to block IPs from country using iptables (e.g. like http://www.cyberciti.biz/faq/block-entier-country-using-iptables/). However I read that the performance can go down if the deny list get too large. An alternative is installing the iptables geoip patch or using ipset ( http://www.jsimmons.co.uk/2010/06/08/using-ipset-with-iptables-in-ubuntu-lts-1004-to-block-large-ip-ranges/) instead of iptables.

Does anyone have experience with the various approaches and can say something about the performance differences ?

Are there are other ways to block country IPs in linux which I did't mentioned above?

Answer 1

I have been using geoip with ipset. i would recommend to use it as it had very low impact on performance on my network. if you use iptables alone, then surely the longer the rule set becomes, the delay for packet traversal will be higher.

IpSet actually matches GROUP of IPs, and the match is done in one swoop, instead of matching each rule for each bock of ips in iptable chains.