I’ve tried finding some resources to help me on my dilemma, but wasn’t successful in my approach. So here goes:
I am implementing an automated firewall manager for Windows Firewall which will ban some offending IP address for a certain port, for a certain period of time, after which the same firewall manager will remove the ban. My trouble is deciding whether I should just stick to creating a new rule for each IP/port pair or create one rule for each port and only edit the IP list to add/remove an IP address. My main consideration would be if one of the approach would yield better performance than the other. It would suit me better to use one rule for each IP/port pair, but I don’t mind going for the other approach if it is significantly better.
I’ve tried asking this on security.stackexchange.com but it’s been marked as off-topic there.
Thanks!
3
Well this answer on ServerFault shows a single rule with many IP blocks works fine, but as he says it take a lot of CPU to process when updating, I imagine the rules are stored internally in an efficient format, and when the rule is changed WF will re-parse and store the IPs. In this case, it doesn’t matter if you have 1 rule with a million IPs or a million rules with 1 IP, except that the time it takes to parse each rule will be different.
Personally I’d go with a half-way house, finding the sweet spot between management and rule size. Probably 1 rule per country or per netblock.
1