Someone asked me this recently and I had no answer for it. I know this is kind of an open-ended question but is there a limit on the numnber of rules you can install in a table/chain? If so, how can I find it out? I guess it will vary across machines.
2 Answers
Quote from Jan Engelhardt
The theoretical upper limit of maximum number of rules for a 32-bit
environment would be somewhere around 38 million, but you could also
construct a rule that is so crowded with matches that even it won't
fit, so the lower limit of max rules is 0.
-
1That's theory, I read some articles that in practice things go south quite rapidly once going over 25k Feb 16, 2013 at 20:19
-
6The point is it entirely depends on the rule complexity and memory availability. As he points out, you can write a single rule that won't fit and thus the max would be 0. FWIW,
service iptables status | wc -l
gives me112373
on one box I admin. 64 bit centos 6 with 96 gigs of ram. There's no problems adding more rules or even reloading with that amount.– R. S.Feb 16, 2013 at 20:45 -
1@kormoc: out of curiosity: what does that box do firewalling for? Firewall stuff is not my dayjob, but over 100000 rules sounds massive and I want to know :)– wzzrdFeb 16, 2013 at 22:18
-
1One of the previous admins setup a brute force blocker that adds a iptable rule for any of the ips that attempt. We have about 6250 'bad' ips blocking 16 ports, 8 tcp and 8 udp. Honestly, we should change the script, but it hasn't caused any issues, so it's left as is and the number slowly creeps up as some other hosts gets owned and scans us.– R. S.Feb 16, 2013 at 22:26
-
2kormoc - you might be better off switching over to using fail2ban. It can be configured to remove blocked ip's over time. Let's face it, scanning 100000 rule sets is going to be a bit slow.– hookenzOct 22, 2013 at 23:54
According linuxquestions.org, on a 32-bit machine, IPTables will support around 25,000 rules. Going beyond that, especially from 27,000, things start to get flaky.
-
1
Jan Engelhardt
and the entire thread that I linked if you want more details, including why modifications after load can crash when the initial load works fine.