I've used several of these for years in conjunction with
ip route add blackhole "${ip}"
Blocking via route uses less CPU and memory than iptables+iplist hashes, but iplist hashes can be useful if you want to track what is being blocked. If using iptables, be sure to block in the raw table to avoid connection tracking table CPU hits.
I've used several of these for years in conjunction with
Blocking via route uses less CPU and memory than iptables+iplist hashes, but iplist hashes can be useful if you want to track what is being blocked. If using iptables, be sure to block in the raw table to avoid connection tracking table CPU hits.