IP Deny blog

We got an email from Cusimano.com person suggesting us to use CIDR zone file merging script from zwitterion.org. We have ran a few in-house tests and this Perl based script effectively decreases CIDR IP block count up to 60% or even more.

The less firewall rules you have set-up in your packet filter (server or firewall) the less matching needs to be done – this effectively decreases load and usage. In the next upcoming week we will fully implement this feature into freely available country zone files.

Thank you for your continued support and feel free to send us more suggestions or recommendations!

Some of our zone data file users are complaining about IP errors or even incorrect data. Unfortunately, we do compile data from regional registries: Ripe, Arin, Apnic, Afrinic, Lacnic and IANA. If the registry publishes not up to date data in their zone files we will probably publish this data in our zone files.

If you have complaints about IP zones that are wrong or not updated, please contact your local registry and ask them to change this information.

IP sets are the best method for blocking specific countries using our IP prefix files for specific countries.

From the IPset homepage:

IP sets are a framework inside the Linux 2.4.x and 2.6.x kernel, which can be administered by the ipset utility. Depending on the type, currently an IP set may store IP addresses, (TCP/UDP) port numbers or IP addresses with MAC addresses in a way, which ensures lightning speed when matching an entry against a set.

If you want to

• store multiple IP addresses or port numbers and match against the collection by iptables at one swoop;
• dynamically update iptables rules against IP addresses or ports without performance penalty;

express complex IP address and ports based rulesets with one single iptables rule and benefit from the speed of IP sets

If you have a network or server with high traffic and using standard iptables for traffic blocking it may affect your server/network performance. With IPsets you can “group” multiple IP sets in groups and then match these in one swoop. This will provide you top performance.

IP sets allows you to bind an entry in a set to another set, which forms a relationship between the set element and the set it is bound to. The sets may have a default binding, which is valid for every set element for which there is no binding defined at all.

Example:

Hello guys. Time is passing and we are finally introducing our new blog – IP Deny blog. We will publish IP, technical guides and hosting related information.

I hope our upcoming posts will have huge interest from our site visitors and we will aim to publish interesting stuff, not junk.

All the best!
IPDeny Staff