Config-Files in /etc/pve FILE TO LARGE

[Virtualizer]

Dear,

config-files under /etc/pve cant been bigger as 130.000 bytes! This is a big big problem, for the firewall blacklist!
We will block in this datas of many IPs wich more as 256 kBytes.

So, my questions are:

Is that possible to include a file in the blacklist from other directory, expl in the cluster.fw

[OPTIONS]


enable: 1
policy_in: ACCEPT


[ALIASES]


// small entries


[IPSET blacklist] # gesperrte IPs

include(/root/ext_blacklist.txt)

OR how is possible to change, that files can been written more as 130.000 bytes?

Regards


Detlef

 

[dietmar]

We will block in this datas of many IPs wich more as 256 kBytes.

Why is your blacklist 256KBytes? The pve firewall is not suitable to manage such large lists.

 

[Virtualizer]

In this blacklist are blocked users they have hack, create abuse or have create DDoS in last 24 hours on others servers too!
We use here the blacklist from blocklist.de! Their are ca. 13.000 IP - addresses inside and we reduce the IPs to CIDRs and reduce the size from 299015 bytes to 168411 bytes.

We have used before in many servers via route blocking without problems!

Regards


Detlef

 

[dietmar]

We have used before in many servers via route blocking without problems!

I thing you should create iptables rules for that outside the pve firewall.

 

[Virtualizer]

but why this will been better? Is that only the problem of the filesize, that Proxmox can not handle?
The blacklist feature will been nice, why all containers they get the feature firewalled had then the blacklists inside and the other containers with not featured firewall can been used without the blacklist.

The other questions was before in other forums, is that better via iptables or route?
With iptables the containers need much numiptent and this shull not good over 500 entries or something about the problem of rules in total of the host, this will been frozen the host. With route this was never a problem!

Is in proxmox a include in the blacklist area possible?

Regards

Detlef

 

[dietmar]

but why this will been better? Is that only the problem of the filesize, that Proxmox can not handle?

Yes, pmxcfs cannot handle such large files, that is the problem.

The blacklist feature will been nice, why all containers they get the feature firewalled had then the blacklists inside and the other containers with not featured firewall can been used without the blacklist.

The other questions was before in other forums, is that better via iptables or route?
With iptables the containers need much numiptent and this shull not good over 500 entries or something about the problem of rules in total of the host, this will been frozen the host. With route this was never a problem!

Not sure what you talk about here? You can also use ipset.

But please lets discuss development related issue on the pve development mailing list. This is the wrong place.

see: http://pve.proxmox.com/wiki/Developer_Documentation

I am sure we will find a solution for that problem.


Is in proxmox a include in the blacklist area possible?

Regards

Detlef[/QUOTE]

 

[spirit]

Why is your blacklist 256KBytes? The pve firewall is not suitable to manage such large lists.

I'm sure that ipset hash:net can handle 65536 entries, maybe more. (and it should be fast)

 

[dietmar]

I'm sure that ipset hash:net can handle 65536 entries, maybe more. (and it should be fast)

@spirit: but pmxcfs file size is limited.

 

[spirit]

@spirit: but pmxcfs file size is limited.

Yes, sure.

Maybe could be add an "include " directive, to include external file with ip list ?

could be usefull to easily wget some public ip blacklists

 

[dietmar]

Maybe could be add an "include " directive, to include external file with ip list ?

Please can we discuss development related issue on the pve development mailing list?