IP Deny blog

Hey folks! Starting from today – we have increased usage limits for IPdeny zone file downloads.

Now you can download up to 5000 zone files daily from one IP;
Usage 5 concurrent connections from one IP;
Recommended wait time between downloading zone files are from 0.5 to 1 second;

Thanks for using our free service!

Hey guys…we received a report that we are missing some IP ranges from APNIC allocations, especially from the New Zealand (NZ) . We will check this out and see why we are missing those ranges as we automatically parse APNIC official  database files. Anyway, thanks for the report and your feedback Dave W.  – we will definitely sort this problem out shortly.

Just browsing around the Internet today I found a nice howto document explaining how to set-up our country IP block data with ipset utility. Ipset utility offers much higher performance than standard iptables rules (one IP range – one record, e.g. 10.1.1.0/16 for example).

Update: August 18th, 2012.
Thanks to our visitor comments we checked itech7 site and it’s registration was expired. We will probably come up with another reference/site shortly.

We had a small problem with European IP address blocks that has been resolved right now. The data files for some of the European countries didn’t list full IP blocks. Our apologies for the problem!

Thanks for the notification Joerg!

We got an email from Cusimano.com person suggesting us to use CIDR zone file merging script from zwitterion.org. We have ran a few in-house tests and this Perl based script effectively decreases CIDR IP block count up to 60% or even more.

The less firewall rules you have set-up in your packet filter (server or firewall) the less matching needs to be done – this effectively decreases load and usage. In the next upcoming week we will fully implement this feature into freely available country zone files.

Thank you for your continued support and feel free to send us more suggestions or recommendations!

Some of our zone data file users are complaining about IP errors, missing IP blocks or even incorrect data. Unfortunately, we do compile data from regional registries: Ripe, Arin, Apnic, Afrinic, Lacnic and IANA. If the registry has an missing IP block in their data files we will miss this IP block in our country zones files as well.

If you have complaints about IP zones that are wrong or not updated, please contact your local registry and ask them to change this information.

IP sets are the best method for blocking specific countries using our IP prefix files for specific countries.

From the IPset homepage:

IP sets are a framework inside the Linux 2.4.x and 2.6.x kernel, which can be administered by the ipset utility. Depending on the type, currently an IP set may store IP addresses, (TCP/UDP) port numbers or IP addresses with MAC addresses in a way, which ensures lightning speed when matching an entry against a set.

If you want to

• store multiple IP addresses or port numbers and match against the collection by iptables at one swoop;
• dynamically update iptables rules against IP addresses or ports without performance penalty;

express complex IP address and ports based rulesets with one single iptables rule and benefit from the speed of IP sets

If you have a network or server with high traffic and using standard iptables for traffic blocking it may affect your server/network performance. With IPsets you can “group” multiple IP sets in groups and then match these in one swoop. This will provide you top performance.

IP sets allows you to bind an entry in a set to another set, which forms a relationship between the set element and the set it is bound to. The sets may have a default binding, which is valid for every set element for which there is no binding defined at all.

Example:

Hello guys. Time is passing and we are finally introducing our new blog – IP Deny blog. We will publish IP, technical guides and hosting related information.

I hope our upcoming posts will have huge interest from our site visitors and we will aim to publish interesting stuff, not junk.

All the best!
IPDeny Staff