Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a server that consistently gets pounded by people trying to break in. We have DenyHosts and Fail2Ban running on the server but it still gets a ton of traffic from people who are up to no good. My boss is finally tired of it, he went to and created a list of ip ranges that he wants to block from the server. The thing is it is a list just over 13,000 ips.

What is the best way to block these ips? I could write a script to loop through the list and add them to iptables but this seems like a bad idea. I can paste the list into DenyHosts but I am not sure what the performance hit on this would be. Would there be a better alternative than either of these?

Is there anyone out there that can give me some advice on this?

share|improve this question
Is it possible to solve this the other way around? BLock everything, then whitelist IPs? – Bonsi Scott Dec 3 '12 at 17:46
For IOS, there are configs out there that include blocks for africa, and prob other problem sources.... – samsmith Dec 3 '12 at 17:58
What service is being attacked? If it's SSH just change port number to some random one (this will get rid of 99% hacking attempts), if it's WWW you might consider using a secure authentication method (no, Basic Authentication is not secure), for FTP you might consider enforcing SSL/TLS authentication (this will also get rid of 99% hacking attempts). If you need to block so many IP addresses then maybe it'd be better to whitelist trusted IPs and block everything else. – FINESEC Dec 3 '12 at 22:27
I wish it was just SSH. It has been an ongoing struggle on this server to keep it secure. – user140816 Dec 4 '12 at 17:19
up vote 2 down vote accepted

Use ipset to create set of IP ranges (with a script probably) and then use --match-set in iptables rule. This way matching will be pretty efficient because ipsets are hashed.

share|improve this answer
Thank you. This is will work out quite well. – user140816 Dec 4 '12 at 17:20

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.