Forum Moderators: open
[edited by: incrediBILL at 8:21 pm (utc) on Nov 23, 2012]
I am trying to stick to IPs that are actually being abusive
A few of the sites I run do not do any business outside the US, but these look like huge chunks to add in htaccess files,
Useless as most IPs you see coming out of China are using IP pools or some fast flux nonsense or something equally as hard to stop so instead of playing whack-a-mole one IP at a time, which would result in a much bigger list in short time, I just blocked the country and never looked back.
these look like huge chunks to add in htaccess
The maddening ones are when a Ukrainian robot is perched on a /24 between two perfectly innocuous pieces of France.
IMO using deny from is an organizational nightmare. mode_rewrite is more compact and more readable.
IMO using deny from is an organizational nightmare. mode_rewrite is more compact and more readable.
And I feel mod_rewrite puts more of a resource strain on the server, especially if you use a lot of conditions that have to be read redundantly.
"There's more than one way to skin a cat".
Done correctly, mod_access can be just as surgical as any other method.
And I feel mod_rewrite puts more of a resource strain on the server
I've always assumed that a formula like
... 12.34.128.0/20
is less resource-greedy than
... %{REMOTE_ADDR} ^12\.34\.1(2[89]|3\d|4[0-3])\.
Note that all Allow and Deny directives are processed, unlike a typical firewall, where only the first match is used. The last match is effective (also unlike a typical firewall). Additionally, the order in which lines appear in the configuration files is not significant -- all Allow lines are processed as one group, all Deny lines are considered as another, and the default state is considered by itself.
This little tidbit, if it works as documented, would imply that a very large list could be really slow
Maybe if I lose my mind later I might post the PHP code used to generate a list for any country.
This little tidbit, if it works as documented, would imply that a very large list could be really slow
@ wilderness, the answer is once.
When you use a mod_rewrite to do the same task, each appearance of a nested condition starts the process back to the start of the line, so it may need to be read many times = greater load on server = greater processing time.
All this is theoretical, but if you have dozens of nested conditions (as I used to have before I switched) it could make a noticeable difference.
And yes, Jim was a big proponent of mod_rewrite, but later switched to mod_authz_host for blocking IP ranges. Somewhere there's a long discussion about this from a few years ago.
SetEnvIf Remote_Addr ^38\.105\.83\.12$ getoutdeny from 5.39.216.0/21deny from 49.50.4.0/22 49.50.8.0/22 110.136.176.0/20 110.139.0.0/16 114.79.18.0/24 etc.
where's my excess server load?
some of the larger ranges *may* include other Pacific actors in Japan, Australia
