Posted by uljanow on Wed 4 Jul 2007 at 11:11
Trying to insert 70.000 rules in iptables on a recent machine takes about an hour and going through these rules for each packet is even more of a burden. But iptables can send packets to userspace to be handled there. This article describes how to filter network traffic based on thousands of IPs with a new tool called nfqueue efficiently.
nfqueue requires a 2.6.14 kernel or later with the option
CONFIG_NETFILTER_XT_TARGET_NFQUEUE enabled (module or build-in). On a standard Debian installation (Etch) the additional packages libnetfilter-queue1 and Install prerequisites Get the Debian nfqueue package and install it IP ranges are specified in p2p, dat, csv text files or in nfq binary format. A p2p format looks like this: A dat file looks like this: (Values less than 127 are dropped.) For available lists take a look at /usr/share/doc/nfqueue/README.lists. Sending packets to userspace is done by using the NFQUEUE target. E.g: From userspace there are basically 3 things one can do with packets. Repeating Packets sends them back to the chain (IN-, OUTPUT or FORWARD)
they came from. Since this could lead to endless loops marking packets
is possible. The other options Accept and Drop are terminating targets. See "man 1 nfqueue" for more details. Get the csv file from webhosting.info Let's assume we want to block the whole US. First we put the ip ranges of
the USA into a nfq binary to make loading faster. The easy way now would be to use the /usr/share/doc/nfqueue/nfqueue.sh script which I will explain later. Updating these values is all that needs to be done: Run: Packets are filtered in the INPUT and OUTPUT chain. For each new connection
(both directions) nfqueue looks if the IP is specified in usa.nfq. If
the IP is found then it gets marked and repeated so that it can be rejected
by iptables. If the IP is not found nfqueue marks the packet to avoid
looping forever and sends it back (repeat again) to be handled by the
rest of the iptables configuration. The script only rejects packets from clients specified in files
and the rest is handled by your iptables configuration. Note that the script rejects packet properly instead of just dropping. There is also an ipset tool from netfiler.org which requires kernel-patching and some scripting to parse the IPs from files and insert them. This article can be found online at the Debian Administration website at the following bookmarkable URL (along with associated comments): This article is copyright 2007 uljanow - please ask for permission to republish or translate.Installation
aptitude install libnetfilter-queue1 libnfnetlink1
wget http://nfqueue.sf.net/debian/nfqueue_0.11-1_i386.deb
dpkg -i nfqueue_0.11-1_i386.deb
Overview
foo : 127.0.0.1 - 127.0.0.2
127.0.0.1, 127.0.0.2, <0-255>, foo
iptables -I INPUT -p all -j NFQUEUE
Example - Blocking whole Countries
wgethttp://ip-to-country.webhosting.info/downloads/ip-to-country.csv.zip
unzip -c ip-to-country.csv.zip | grep -i usa | \
nfqueue -t repeat -o usa.nfq -
INPUT_FILES=/path/to/usa.nfq
OUTPUT_FILES=/path/to/usa.nfq
nfqueue.sh start
nfqueue.sh stop
nfqueue.sh status
nfqueue.sh Script
What does the script do exactly
Notes