ip route multiple entries
I have a list of 60k CIDRs to block and I am planning to do this using the following command.
ip route add blackhole 1.0.1.0/24
Is there a way I can import the whole list on my Ubuntu 18 server or is there any place where I can manually enter the entire list?
Is there a chance of the server becoming slow or unstable after adding 60k entries?
networking server ip
asked Jan 2 at 6:00
Kolkata Calcutta
232
New contributor
Kolkata Calcutta is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
I have a list of 60k CIDRs to block and I am planning to do this using the following command.
ip route add blackhole 1.0.1.0/24
Is there a way I can import the whole list on my Ubuntu 18 server or is there any place where I can manually enter the entire list?
Is there a chance of the server becoming slow or unstable after adding 60k entries?
networking server ip
asked Jan 2 at 6:00
Kolkata Calcutta
232
New contributor
Kolkata Calcutta is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
5
Why dont you just use iptables to block a range of ip's ?
– hello moto
Jan 2 at 6:09
@hellomoto Is it likely to create a performance issue if I user iptables / ipset / ip route with so many entries?
– Kolkata Calcutta
Jan 2 at 8:13
1
@hellomoto If you have 60k rules multiplied by 100k packets per seconds, that's a lot of comparisons per second... It may very well create a performance problem.
– vidarlo
Jan 2 at 9:52
add a comment |
I have a list of 60k CIDRs to block and I am planning to do this using the following command.
ip route add blackhole 1.0.1.0/24
Is there a way I can import the whole list on my Ubuntu 18 server or is there any place where I can manually enter the entire list?
Is there a chance of the server becoming slow or unstable after adding 60k entries?
networking server ip
asked Jan 2 at 6:00
Kolkata Calcutta
232
New contributor
Kolkata Calcutta is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
I have a list of 60k CIDRs to block and I am planning to do this using the following command.
ip route add blackhole 1.0.1.0/24
Is there a way I can import the whole list on my Ubuntu 18 server or is there any place where I can manually enter the entire list?
Is there a chance of the server becoming slow or unstable after adding 60k entries?
networking server ip
networking server ip
asked Jan 2 at 6:00
Kolkata Calcutta
232
New contributor
Kolkata Calcutta is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked Jan 2 at 6:00
Kolkata Calcutta
232
New contributor
Kolkata Calcutta is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked Jan 2 at 6:00
Kolkata Calcutta
232
New contributor
Kolkata Calcutta is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked Jan 2 at 6:00
Kolkata Calcutta
232
asked Jan 2 at 6:00
Kolkata Calcutta
232
232
New contributor
Kolkata Calcutta is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
New contributor
Kolkata Calcutta is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
Kolkata Calcutta is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
5
Why dont you just use iptables to block a range of ip's ?
– hello moto
Jan 2 at 6:09
@hellomoto Is it likely to create a performance issue if I user iptables / ipset / ip route with so many entries?
– Kolkata Calcutta
Jan 2 at 8:13
1
@hellomoto If you have 60k rules multiplied by 100k packets per seconds, that's a lot of comparisons per second... It may very well create a performance problem.
– vidarlo
Jan 2 at 9:52
add a comment |
5
Why dont you just use iptables to block a range of ip's ?
– hello moto
Jan 2 at 6:09
@hellomoto Is it likely to create a performance issue if I user iptables / ipset / ip route with so many entries?
– Kolkata Calcutta
Jan 2 at 8:13
1
@hellomoto If you have 60k rules multiplied by 100k packets per seconds, that's a lot of comparisons per second... It may very well create a performance problem.
– vidarlo
Jan 2 at 9:52
5
5
Why dont you just use iptables to block a range of ip's ?
– hello moto
Jan 2 at 6:09
Why dont you just use iptables to block a range of ip's ?
– hello moto
Jan 2 at 6:09
@hellomoto Is it likely to create a performance issue if I user iptables / ipset / ip route with so many entries?
– Kolkata Calcutta
Jan 2 at 8:13
@hellomoto Is it likely to create a performance issue if I user iptables / ipset / ip route with so many entries?
– Kolkata Calcutta
Jan 2 at 8:13
1
1
@hellomoto If you have 60k rules multiplied by 100k packets per seconds, that's a lot of comparisons per second... It may very well create a performance problem.
– vidarlo
Jan 2 at 9:52
@hellomoto If you have 60k rules multiplied by 100k packets per seconds, that's a lot of comparisons per second... It may very well create a performance problem.
– vidarlo
Jan 2 at 9:52
add a comment |
1 Answer
1
active
oldest
votes
If you have them listed as one per line, it's trivial to script this:
for ip in $(cat filename.txt)
do
ip route add blackhole $ip
done
As hello moto said in a comment: why not use iptables to filter? To do that...
for ip in $(cat filename.txt)
do
iptables -A INPUT -s $ip -j DROP
done
With 60k rules, I would have a look at ipset, to avoid crippling performance. If you have 60k rules and 100kpps, thats 60k*100k=6 billion comparisons per second...
This documentation from Arch is somewhat more friendly than the manpage for ipset, and the syntax applies for Ubuntu as well.
To use ipset:
ipset create blocklist
for ip in $(filename.txt)
do
ipset add blocklist $ip
done
iptables -I INPUT -m set --match-set blocklist src -j DROP
In addition iprange may be useful. It takes a lists of subnets, and tries to merge networks into as few subnets as possible, which would reduce the number of comparisons needed.
answered Jan 2 at 7:21
vidarlo
9,35942445
are you suggesting ipset would be better than choosing ip route and iptables commands?
– Kolkata Calcutta
Jan 2 at 8:16
1
Yes. Ipset makes a hash table which enables cheaper look ups.
– vidarlo
Jan 2 at 8:18
I am wondering, is it possible to block ASN instead of blocking individual CIDRs?
– Kolkata Calcutta
Jan 2 at 8:22
1
No. Ip packets does not carry information about asn.
– vidarlo
Jan 2 at 8:24
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "89"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Kolkata Calcutta is a new contributor. Be nice, and check out our Code of Conduct.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f1106166%2fip-route-multiple-entries%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
If you have them listed as one per line, it's trivial to script this:
for ip in $(cat filename.txt)
do
ip route add blackhole $ip
done
As hello moto said in a comment: why not use iptables to filter? To do that...
for ip in $(cat filename.txt)
do
iptables -A INPUT -s $ip -j DROP
done
With 60k rules, I would have a look at ipset, to avoid crippling performance. If you have 60k rules and 100kpps, thats 60k*100k=6 billion comparisons per second...
This documentation from Arch is somewhat more friendly than the manpage for ipset, and the syntax applies for Ubuntu as well.
To use ipset:
ipset create blocklist
for ip in $(filename.txt)
do
ipset add blocklist $ip
done
iptables -I INPUT -m set --match-set blocklist src -j DROP
In addition iprange may be useful. It takes a lists of subnets, and tries to merge networks into as few subnets as possible, which would reduce the number of comparisons needed.
answered Jan 2 at 7:21
vidarlo
9,35942445
are you suggesting ipset would be better than choosing ip route and iptables commands?
– Kolkata Calcutta
Jan 2 at 8:16
1
Yes. Ipset makes a hash table which enables cheaper look ups.
– vidarlo
Jan 2 at 8:18
I am wondering, is it possible to block ASN instead of blocking individual CIDRs?
– Kolkata Calcutta
Jan 2 at 8:22
1
No. Ip packets does not carry information about asn.
– vidarlo
Jan 2 at 8:24
add a comment |
If you have them listed as one per line, it's trivial to script this:
for ip in $(cat filename.txt)
do
ip route add blackhole $ip
done
As hello moto said in a comment: why not use iptables to filter? To do that...
for ip in $(cat filename.txt)
do
iptables -A INPUT -s $ip -j DROP
done
With 60k rules, I would have a look at ipset, to avoid crippling performance. If you have 60k rules and 100kpps, thats 60k*100k=6 billion comparisons per second...
This documentation from Arch is somewhat more friendly than the manpage for ipset, and the syntax applies for Ubuntu as well.
To use ipset:
ipset create blocklist
for ip in $(filename.txt)
do
ipset add blocklist $ip
done
iptables -I INPUT -m set --match-set blocklist src -j DROP
In addition iprange may be useful. It takes a lists of subnets, and tries to merge networks into as few subnets as possible, which would reduce the number of comparisons needed.
answered Jan 2 at 7:21
vidarlo
9,35942445
are you suggesting ipset would be better than choosing ip route and iptables commands?
– Kolkata Calcutta
Jan 2 at 8:16
1
Yes. Ipset makes a hash table which enables cheaper look ups.
– vidarlo
Jan 2 at 8:18
I am wondering, is it possible to block ASN instead of blocking individual CIDRs?
– Kolkata Calcutta
Jan 2 at 8:22
1
No. Ip packets does not carry information about asn.
– vidarlo
Jan 2 at 8:24
add a comment |
If you have them listed as one per line, it's trivial to script this:
for ip in $(cat filename.txt)
do
ip route add blackhole $ip
done
As hello moto said in a comment: why not use iptables to filter? To do that...
for ip in $(cat filename.txt)
do
iptables -A INPUT -s $ip -j DROP
done
With 60k rules, I would have a look at ipset, to avoid crippling performance. If you have 60k rules and 100kpps, thats 60k*100k=6 billion comparisons per second...
This documentation from Arch is somewhat more friendly than the manpage for ipset, and the syntax applies for Ubuntu as well.
To use ipset:
ipset create blocklist
for ip in $(filename.txt)
do
ipset add blocklist $ip
done
iptables -I INPUT -m set --match-set blocklist src -j DROP
In addition iprange may be useful. It takes a lists of subnets, and tries to merge networks into as few subnets as possible, which would reduce the number of comparisons needed.
answered Jan 2 at 7:21
vidarlo
9,35942445
If you have them listed as one per line, it's trivial to script this:
for ip in $(cat filename.txt)
do
ip route add blackhole $ip
done
As hello moto said in a comment: why not use iptables to filter? To do that...
for ip in $(cat filename.txt)
do
iptables -A INPUT -s $ip -j DROP
done
With 60k rules, I would have a look at ipset, to avoid crippling performance. If you have 60k rules and 100kpps, thats 60k*100k=6 billion comparisons per second...
This documentation from Arch is somewhat more friendly than the manpage for ipset, and the syntax applies for Ubuntu as well.
To use ipset:
ipset create blocklist
for ip in $(filename.txt)
do
ipset add blocklist $ip
done
iptables -I INPUT -m set --match-set blocklist src -j DROP
In addition iprange may be useful. It takes a lists of subnets, and tries to merge networks into as few subnets as possible, which would reduce the number of comparisons needed.
answered Jan 2 at 7:21
vidarlo
9,35942445
edited Jan 2 at 12:04
answered Jan 2 at 7:21
vidarlo
9,35942445
answered Jan 2 at 7:21
vidarlo
9,35942445
answered Jan 2 at 7:21
vidarlo
9,35942445
9,35942445
are you suggesting ipset would be better than choosing ip route and iptables commands?
– Kolkata Calcutta
Jan 2 at 8:16
1
Yes. Ipset makes a hash table which enables cheaper look ups.
– vidarlo
Jan 2 at 8:18
I am wondering, is it possible to block ASN instead of blocking individual CIDRs?
– Kolkata Calcutta
Jan 2 at 8:22
1
No. Ip packets does not carry information about asn.
– vidarlo
Jan 2 at 8:24
add a comment |
are you suggesting ipset would be better than choosing ip route and iptables commands?
– Kolkata Calcutta
Jan 2 at 8:16
1
Yes. Ipset makes a hash table which enables cheaper look ups.
– vidarlo
Jan 2 at 8:18
I am wondering, is it possible to block ASN instead of blocking individual CIDRs?
– Kolkata Calcutta
Jan 2 at 8:22
1
No. Ip packets does not carry information about asn.
– vidarlo
Jan 2 at 8:24
are you suggesting ipset would be better than choosing ip route and iptables commands?
– Kolkata Calcutta
Jan 2 at 8:16
are you suggesting ipset would be better than choosing ip route and iptables commands?
– Kolkata Calcutta
Jan 2 at 8:16
1
1
Yes. Ipset makes a hash table which enables cheaper look ups.
– vidarlo
Jan 2 at 8:18
Yes. Ipset makes a hash table which enables cheaper look ups.
– vidarlo
Jan 2 at 8:18
I am wondering, is it possible to block ASN instead of blocking individual CIDRs?
– Kolkata Calcutta
Jan 2 at 8:22
I am wondering, is it possible to block ASN instead of blocking individual CIDRs?
– Kolkata Calcutta
Jan 2 at 8:22
1
1
No. Ip packets does not carry information about asn.
– vidarlo
Jan 2 at 8:24
No. Ip packets does not carry information about asn.
– vidarlo
Jan 2 at 8:24
add a comment |
Kolkata Calcutta is a new contributor. Be nice, and check out our Code of Conduct.
Kolkata Calcutta is a new contributor. Be nice, and check out our Code of Conduct.
Kolkata Calcutta is a new contributor. Be nice, and check out our Code of Conduct.
Kolkata Calcutta is a new contributor. Be nice, and check out our Code of Conduct.
Thanks for contributing an answer to Ask Ubuntu!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f1106166%2fip-route-multiple-entries%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
5
Why dont you just use iptables to block a range of ip's ?
– hello moto
Jan 2 at 6:09
@hellomoto Is it likely to create a performance issue if I user iptables / ipset / ip route with so many entries?
– Kolkata Calcutta
Jan 2 at 8:13
1
@hellomoto If you have 60k rules multiplied by 100k packets per seconds, that's a lot of comparisons per second... It may very well create a performance problem.
– vidarlo
Jan 2 at 9:52