<html><head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head><body bgcolor="#FFFFFF" text="#000000">You could very well do a
small ipset together with iptables, it's fast, and you don't have to
reload for every subnet / ip you add.<br>
Doing it within nginx is rather.. Yeah.<br>
<br>
<div class="moz-signature">-- <br>Best Regards,<br>
Lucas Rolff<br>
</div>
<br>
<br>
<span>Cox, Eric S wrote:</span><br>
<blockquote
cite="mid:74A4D440E25E6843BC8E324E67BB3E394558B05D@N060XBOXP38.kroger.com"
type="cite">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<span style="font-family:Calibri,Arial,Helvetica,sans-serif;
font-size:11pt; color:black">Random, blocks, certain durations, etc. Its
very random and or short lived which is something we don't want to move
to the firewall at the moment
<br>
<br>
<span style="color:black">-----Original Message----- <br>
<b>From:</b> Jeff Dyke [<a class="moz-txt-link-abbreviated" href="mailto:jeff.dyke@gmail.com">jeff.dyke@gmail.com</a>]<br>
<b>Received:</b> Tuesday, 01 Nov 2016, 5:46PM<br>
<b>To:</b> <a class="moz-txt-link-abbreviated" href="mailto:nginx@nginx.org">nginx@nginx.org</a> [<a class="moz-txt-link-abbreviated" href="mailto:nginx@nginx.org">nginx@nginx.org</a>]<br>
<b>Subject:</b> Re: Blocking tens of thousands of IP's<br>
<br>
</span></span>
<div>
<div dir="ltr">what is your firewall?, that is the place to block
subnets etc, i assume they are not random ips, they are likely from a
block owned by someone??</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Tue, Nov 1, 2016 at 5:37 PM, CJ Ess <span
dir="ltr"><<a moz-do-not-send="true"
href="mailto:zxcvbn4038@gmail.com" target="_blank">zxcvbn4038@gmail.com</a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;
border-left:1px #ccc solid; padding-left:1ex"><div dir="ltr">I don't
think managing large lists of IPs is nginx's strength - as far as I can
tell all of its ACLs are arrays that have the be iterated through on
each request.
<div><br>
</div>
<div>When I do have to manage IP lists in Nginx I try to compress the
lists into the most compact CIDR representation so there is less to
search. Here is a perl snippet I use to do that (handles ipv4 and ipv6):</div>
<div><br>
</div>
<div>#!/usr/bin/perl</div>
<div><br>
</div>
<div>
<div>use NetAddr::IP;<br>
</div>
<div><br>
</div>
<div>my @addresses;<br>
</div>
<div><br>
</div>
<div>foreach my $subnet (split(/\s+/, $list_of_ips)) {<br>
</div>
<div> push(@addresses, NetAddr::IP->new($subnet));<br>
</div>
<div>}</div>
<div><br>
</div>
</div>
<div>
<div>foreach my $cidr (NetAddr::IP::compact(@<wbr>addresses)) {</div>
<div> if ($cidr->version == 4) {</div>
<div> print $cidr . "\n";</div>
<div> } else {</div>
<div> print $cidr->short() . "/" . $cidr->masklen() . "\n";</div>
<div>}</div>
<div><br>
</div>
</div>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">
<div>
<div class="h5">On Tue, Nov 1, 2016 at 11:15 AM, Cox, Eric S <span
dir="ltr"><<a moz-do-not-send="true"
href="mailto:eric.cox@kroger.com" target="_blank">eric.cox@kroger.com</a>></span>
wrote:<br>
</div>
</div>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;
border-left:1px #ccc solid; padding-left:1ex"><div>
<div class="h5">
<div lang="EN-US">
<div class="m_-1613116173903862241m_-5536988672632864200WordSection1">
<p class="MsoNormal">Is anyone aware of a difference performance wise
between using
</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">return 403;</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">vs</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">deny all; </p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">When mapping against a list of tens of thousands of
ip?</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Thanks </p>
</div>
<br>
<hr>
<font color="Gray" face="Arial" size="2"><br>
This e-mail message, including any attachments, is for the sole use of
the intended recipient(s) and may contain information that is
confidential and protected by law from unauthorized disclosure. Any
unauthorized review, use, disclosure or distribution is
prohibited. If you are not the intended recipient, please contact the
sender by reply e-mail and destroy all copies of the original message.<br>
</font></div>
<br>
</div>
</div>
______________________________<wbr>_________________<br>
nginx mailing list<br>
<a moz-do-not-send="true" href="mailto:nginx@nginx.org" target="_blank">nginx@nginx.org</a><br>
<a moz-do-not-send="true"
href="https://urldefense.proofpoint.com/v2/url?u=http-3A__mailman.nginx.org_mailman_listinfo_nginx&d=CwMFaQ&c=WUZzGzAb7_N4DvMsVhUlFrsw4WYzLoMP5bgx2U7ydPE&r=20GRp3QiDlDBgTH4mxQcOIMPCXcNvWGMx5Y0qmfF8VE&m=cjLNEY1x_976qWvGzhCEhvWYUU4DOBVUcO97nnDYX7o&s=GwNGeoaXa46JaCsfrdl3VQZpyNHqSzWwlLq3a0UNV2I&e="
rel="noreferrer" target="_blank">http://mailman.nginx.org/mailm<wbr>an/listinfo/nginx</a><br></blockquote>
</div>
<br>
</div>
<br>
______________________________<wbr>_________________<br>
nginx mailing list<br>
<a moz-do-not-send="true" href="mailto:nginx@nginx.org">nginx@nginx.org</a><br>
<a moz-do-not-send="true"
href="https://urldefense.proofpoint.com/v2/url?u=http-3A__mailman.nginx.org_mailman_listinfo_nginx&d=CwMFaQ&c=WUZzGzAb7_N4DvMsVhUlFrsw4WYzLoMP5bgx2U7ydPE&r=20GRp3QiDlDBgTH4mxQcOIMPCXcNvWGMx5Y0qmfF8VE&m=cjLNEY1x_976qWvGzhCEhvWYUU4DOBVUcO97nnDYX7o&s=GwNGeoaXa46JaCsfrdl3VQZpyNHqSzWwlLq3a0UNV2I&e="
rel="noreferrer" target="_blank">http://mailman.nginx.org/<wbr>mailman/listinfo/nginx</a><br></blockquote>
</div>
<br>
</div>
</div>
<br>
<hr>
<font color="Gray" face="Arial" size="2"><br>
This e-mail message, including any attachments, is for the sole use of
the intended recipient(s) and may contain information that is
confidential and protected by law from unauthorized disclosure. Any
unauthorized review, use, disclosure or distribution is
prohibited. If you are not the intended recipient, please contact the
sender by reply e-mail and destroy all copies of the original message.<br>
</font>
<pre wrap="">_______________________________________________
nginx mailing list
<a class="moz-txt-link-abbreviated" href="mailto:nginx@nginx.org">nginx@nginx.org</a>
<a class="moz-txt-link-freetext" href="http://mailman.nginx.org/mailman/listinfo/nginx">http://mailman.nginx.org/mailman/listinfo/nginx</a></pre>
</blockquote>
<br>
</body></html>