Home / server / Questions / 929850
In Process
tomsk
Asked: 2018-09-08 00:44:12 +0800 CST

GeoIP vs IPset performance in iptables

  • 772

I would like to ask you what is faster in term of performance GeoIP or IPset.

Let me explain, imagine that I have rule:

iptables -A INPUT -m geoip ! --src-cc US,UK,CA -j DROP

And imagine that I have IPset of hash:net and I put all these IPs (from US, UK and CA) into hash:net country_whitelist set.

iptables -A INPUT -m set --match-set country_whitelist src -j ACCEPT

What is faster? GeoIP or IPset? We know that IPset is fast because it uses hash table (for hashes), but I don't know how does GeoIP work, if it isn't like 1 subnet for 1 rule.

iptables

0 Answers