Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Someone asked me this recently and I had no answer for it. I know this is kind of an open-ended question but is there a limit on the numnber of rules you can install in a table/chain? If so, how can I find it out? I guess it will vary across machines.

share|improve this question
1  
try adding with a forloop until your machine crashes. –  Lucas Kauffman Feb 16 '13 at 20:08
    
it entirely depends on the rule complexity. See my answer from Jan Engelhardt and the entire thread that I linked if you want more details, including why modifications after load can crash when the initial load works fine. –  kormoc Feb 16 '13 at 20:11

2 Answers 2

up vote 4 down vote accepted

Quote from Jan Engelhardt

The theoretical upper limit of maximum number of rules for a 32-bit
environment would be somewhere around 38 million, but you could also
construct a rule that is so crowded with matches that even it won't
fit, so the lower limit of max rules is 0.

http://www.spinics.net/lists/netfilter/msg51895.html

share|improve this answer
    
That's theory, I read some articles that in practice things go south quite rapidly once going over 25k –  Lucas Kauffman Feb 16 '13 at 20:19
3  
The point is it entirely depends on the rule complexity and memory availability. As he points out, you can write a single rule that won't fit and thus the max would be 0. FWIW, service iptables status | wc -l gives me 112373 on one box I admin. 64 bit centos 6 with 96 gigs of ram. There's no problems adding more rules or even reloading with that amount. –  kormoc Feb 16 '13 at 20:45
    
@kormoc: out of curiosity: what does that box do firewalling for? Firewall stuff is not my dayjob, but over 100000 rules sounds massive and I want to know :) –  wzzrd Feb 16 '13 at 22:18
1  
One of the previous admins setup a brute force blocker that adds a iptable rule for any of the ips that attempt. We have about 6250 'bad' ips blocking 16 ports, 8 tcp and 8 udp. Honestly, we should change the script, but it hasn't caused any issues, so it's left as is and the number slowly creeps up as some other hosts gets owned and scans us. –  kormoc Feb 16 '13 at 22:26
    
kormoc - you might be better off switching over to using fail2ban. It can be configured to remove blocked ip's over time. Let's face it, scanning 100000 rule sets is going to be a bit slow. –  Matt Oct 22 '13 at 23:54

According to my most recent google, on a 32 bit machine, IPTables will support around 25.000 rules, going beyond that, especially from 27.000 things start to get flaky.

share|improve this answer
1  
Can you please provide some links to articles to support this. –  Bruce Feb 16 '13 at 20:21
1  

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.