Post #1559067
2026-01-27 22:44 UTC
Replies (3)
-
@dalias@hachyderm.io 2026-01-28 00:11
@osm_tech @BalooUriza For IPv4, a bitmask of the entire address space is a viable "efficient" implementation of blocking. I wonder if there are tools that can do it that way rather than needing a gigantic list.
-
@mnalis@mastodon.online 2026-01-28 15:47
@osm_tech @BalooUriza is it using ipset hashsets, or default rule-per-ip rules? raw namespace or? I don't know the details of implementation, but if it is L7 load that is problematic (instead of pure bandwidth DDoS), it might be worth to consider whitelisting instead. I.e. whitelist addresses (or /24s) that have *not* had excessive requests lately, and put them in priority network bucket, and the rest (which is not blacklisted) goes in best-effort bucket (to maybe migrate to whitelist later)
-
@mia@shrimptest.0x0.st 2026-01-29 15:32
@osm_tech @BalooUriza i noticed this too! for when bots were hammering my git forge, i wrote a small script that would watch the systemd journal for when go-away identified a bot, and add that to an ipset for efficient in-kernel blocking of requests. the default ipset size was too small, but it can handle millions of addresses with no noticeable performance hit. each entry would expire after a configurable duration.