Max number of IPs for each firewall rule

Question

In the DO firewall documentation I read that firewalls are limited to 50 rules.

However, how many IPs (or IP ranges) I can insert in a firewall rule?

For example, if I want to block a list of hundreds/thousands of IPs (blacklist), can I do that?

Probably you should also clarify that in the official docs if a limit exists.

Answer 1

bboucheron April 27, 2020

Hi Marco. Thanks for the question. I’ve consulted with one of the engineers on our Cloud Firewalls team:

Unfortunately, you can’t really do an IP blocklist at all, because the firewall product blocks everything by default, and requires you to specify allow rules only. There is no syntax for a negative set (“allow anything NOT in this list of IPs”).
There is a size limit for firewall rules, but it’s not easy to specify the limit as an exact number of IPs, as it is affected by the particulars of your setup. With a very simple rule set, this engineer found the limit was around 20k IPs.
A large rule set like this can negatively impact your network performance, even if it does avoid the size limit.

Thanks!

Reply Report

Related