About how many deny i.p.'s is the max?

dwhswebhosting

Does anyone know about how many deny from i.p.'s you can add in apache without losing any stability?

My list of bad sites are getting huge??

Thanks, Charles

goldbug

Not sure... are you using your apache config as a makeshift firewall??

dwhswebhosting

Actually I am trying to keep it simple and just adding the i.p.'s to block in the:

Order deny,allow
Deny from all

Option in Apache,

I heard from another forum that you can put a unlimited amount of deny i.p.'s in the apache file but at the same time several people said it doesn't matter the size of apache for speed and load perform.

I am almost sure the more host names and deny i.p.'s there are in Apache, that it effects it's performance.

I just can't say for sure.

Thanks...

goldbug

Well, if you had like 4 million IPs listed as blocked in apache config files, It would probably degrade performance solely due to the time it takes to read/cache all of those.

Now, I'm no Apache expert, and don't claim to be....
Is it possible to deny blocks of IP addresses (like a real firewall)?
For example, blocking 10.0.0.0/24 instead of 10.0.0.1, 10.0.0.2, 10.0.0.3, etc... ?

That way, you could just block a "troublesome" group of IP addresses all at once.

Another option, but yet again, I'm hypothesizing, haven't actually looked into it:
could you use some authentication module tied in with a database (mod_auth_mysql?), so the database does the grunt work of the lookup?

Just an idea, I have no idea if it's possible. 🙂

dwhswebhosting

Makes since to me too,

Thanks dude..

I am trying to work on a apache plug in that connects to a centralized black list for all servers.

Someday.. 😃

When you have a couple hundred servers, editing each apache file sucks...

Have a good weekend.

-Charles

Arenium

you could always just write a shell script to do it...i think...

Mordecai

Eeer... I'd say probably after a couple thousand (maybe only 1,000), it'll start to get slower and slower (at least it will become noticeable).

stolzyboy

apache would laugh at 1000 ip's, i would get concerned when it hits the higher thousands, ie. 6, 7, etc.... you will certainly then have problems with performance