I have read some answers here about blocking IP address ranges, and have already used
iptables for this purpose before. It is suggested to use
ipset in combination with
I have only installed ipset but have not configured it yet.
I found this site ip2location.com to generate a list of IPs to ban by country. I selected the 5 countries that target our sites regularly, but the list is huge, 256000 rows.
- Would this massive list slow down my server when using
ipset(before attempting this using only IPtables I questioned such a large file might slow performance.).
- If that is the case, what is the way to do this? At the moment I use fail2ban but I do not think the configuration for nginx is correctly setup (I assume regex). In any case, I need a more robust way.
- Finally, I do not claim to understand CIDR enough to make this list smaller (aggregate similar IP ranges if possible).
For instance, there are several /21 entries :
An online tool shows this resolves to : 126.96.36.199 to 188.8.131.52
I do not think there is any easy way to make the entries less, so any advice regarding implementation and performance issues please.