13

Someone asked me this recently and I had no answer for it. I know this is kind of an open-ended question but is there a limit on the numnber of rules you can install in a table/chain? If so, how can I find it out? I guess it will vary across machines.

|improve this question|||||
  • 1
    try adding with a forloop until your machine crashes. – Lucas Kauffman Feb 16 '13 at 20:08
  • it entirely depends on the rule complexity. See my answer from Jan Engelhardt and the entire thread that I linked if you want more details, including why modifications after load can crash when the initial load works fine. – R. S. Feb 16 '13 at 20:11
12

Quote from Jan Engelhardt

The theoretical upper limit of maximum number of rules for a 32-bit
environment would be somewhere around 38 million, but you could also
construct a rule that is so crowded with matches that even it won't
fit, so the lower limit of max rules is 0.

http://www.spinics.net/lists/netfilter/msg51895.html

|improve this answer|||||
  • 1
    That's theory, I read some articles that in practice things go south quite rapidly once going over 25k – Lucas Kauffman Feb 16 '13 at 20:19
  • 6
    The point is it entirely depends on the rule complexity and memory availability. As he points out, you can write a single rule that won't fit and thus the max would be 0. FWIW, service iptables status | wc -l gives me 112373 on one box I admin. 64 bit centos 6 with 96 gigs of ram. There's no problems adding more rules or even reloading with that amount. – R. S. Feb 16 '13 at 20:45
  • 1
    @kormoc: out of curiosity: what does that box do firewalling for? Firewall stuff is not my dayjob, but over 100000 rules sounds massive and I want to know :) – wzzrd Feb 16 '13 at 22:18
  • 1
    One of the previous admins setup a brute force blocker that adds a iptable rule for any of the ips that attempt. We have about 6250 'bad' ips blocking 16 ports, 8 tcp and 8 udp. Honestly, we should change the script, but it hasn't caused any issues, so it's left as is and the number slowly creeps up as some other hosts gets owned and scans us. – R. S. Feb 16 '13 at 22:26
  • 2
    kormoc - you might be better off switching over to using fail2ban. It can be configured to remove blocked ip's over time. Let's face it, scanning 100000 rule sets is going to be a bit slow. – Matt Oct 22 '13 at 23:54
7

According linuxquestions.org, on a 32-bit machine, IPTables will support around 25,000 rules. Going beyond that, especially from 27,000, things start to get flaky.

|improve this answer|||||
  • how about a 64-bit Ubuntu 16.04LTS? – 23r23f23q May 8 '18 at 17:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.