I don't think managing large lists of IPs is nginx's strength - as far as I
can tell all of its ACLs are arrays that have the be iterated through on
each request.
When I do have to manage IP lists in Nginx I try to compress the lists into
the most compact CIDR representation so there is less to search. Here is a
perl snippet I use to do that (handles ipv4 and ipv6):
#!/usr/bin/perl
use NetAddr::IP;
my @addresses;
foreach my $subnet (split(/\s+/, $list_of_ips)) {
push(@addresses, NetAddr::IP->new($subnet));
}
foreach my $cidr (NetAddr::IP::compact(@addresses)) {
if ($cidr->version == 4) {
print $cidr . "\n";
} else {
print $cidr->short() . "/" . $cidr->masklen() . "\n";
}
On Tue, Nov 1, 2016 at 11:15 AM, Cox, Eric S <eric....@kroger.com> wrote:
> Is anyone aware of a difference performance wise between using
>
>
>
> return 403;
>
>
>
> vs
>
>
>
> deny all;
>
>
>
> When mapping against a list of tens of thousands of ip?
>
>
>
> Thanks
>
> ------------------------------
>
> This e-mail message, including any attachments, is for the sole use of the
> intended recipient(s) and may contain information that is confidential and
> protected by law from unauthorized disclosure. Any unauthorized review,
> use, disclosure or distribution is prohibited. If you are not the intended
> recipient, please contact the sender by reply e-mail and destroy all copies
> of the original message.
>
> _______________________________________________
> nginx mailing list
> nginx@nginx.org
> http://mailman.nginx.org/mailman/listinfo/nginx
>
_______________________________________________
nginx mailing list
nginx@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx
