iptables versus hosts denied

Tue Oct 16 16:29:07 UTC 2007

-----Original Message-----
From:	fedora-list-bounces at redhat.com on behalf of Ashley M. Kirchner
Sent:	Tue 10/16/2007 12:10 PM
To:	For users of Fedora Core releases
Cc:	
Subject:	iptables versus hosts denied

    In terms of performance and when a packet is dropped or denied, 
what's best to use?  iptables or hosts.deny ?  Let's assume for a moment 
here that one has a very long list of IP ranges that are being blocked, 
would using iptables to deny the ranges work better/faster than having 
hosts.deny block them?  Just wondering ...

-----------------------------

iptables will drop the packet at the kernel level.

An application with tcp_wrapper support will consult the hosts.allow and hosts.deny files to determine whether or not to accept a TCP connection.

I would expect that iptables would be faster since the work is being done within the kernel.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: winmail.dat
Type: application/ms-tnef
Size: 2893 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/fedora-list/attachments/20071016/97cc63a9/attachment-0001.bin>