CRITICAL OPTIMIZATION:
Replaced slow CSF serial blocking with IPset hash table for instant
mass IP blocking during DDoS attacks.
BEFORE (CSF only):
- 100 IPs = 100+ seconds (serial blocking)
- Each block: sleep 0.8s + 3x expensive verification
- Cache rebuild after EVERY block
- 200+ iptables queries for verification
AFTER (IPset):
- 100 IPs = <1 second (hash table)
- Single iptables rule blocks entire set
- O(1) lookups vs O(n) rule iteration
- Native TTL support (auto-expiry)
- No verification overhead
IMPLEMENTATION:
1. Create temp IPset on startup: live_monitor_$$
2. Single iptables rule: -m set --match-set <name> src -j DROP
3. Batch blocking: batch_block_ips() for multiple IPs
4. Individual blocking: Uses ipset if available, falls back to CSF
5. Auto cleanup on exit: Removes ipset + iptables rule
FEATURES:
- Native 1-hour timeout per IP (configurable)
- Supports up to 65,536 IPs
- Temp-only (removed on script exit)
- CSF fallback if ipset unavailable
- IP validation before blocking
PERFORMANCE GAIN:
- 100x faster blocking during DDoS
- Minimal CPU overhead
- Scales to 10,000+ IPs easily
cschantz
7393067a97