Tony Stohne wrote:
Yes, putting the domain/IP address in the host file works, but has the negative side effect of being slower (at least if your host file is big. Parsing a big hosts file slows down networking overall because of the parsing process. If the file is small/short it's not a big problem). With TCP reset,
My hosts file is quite short; only two rows, currently.
it's a lot quicker. If You want to block lots of ads/banner domains and/or malware/porn sites it's usually more efficient to use TCP reset, within reason of course... huge iptables blocks tend to slow things down as well unless You use IPset (an extension of iptables). Shorewall actually supports IPset, if You have those extensions compiled in Your kernel... IPset is a means of creating hashes for one or more address blocks or addresses, which speeds things up quite a lot. See http://ipset.netfilter.org/ and http://www.shorewall.net/ipsets.html BTW, Gentoo supports IPsets - in Portage it's under net-firewall/ipset but You have to recompile Your kernel, which may be too much work for You since we're discussing one domain/IP address in this case.
Nice tip! Thanks!
Have a nice Sunday :)
Well, I'll be cooking meals for the coming work week so I'll be having fun... ;-)
I surely will as I'm watching F1 at Monza right now :)
Sounds great, although not really my cup of tea. :-) Best regards Peter K
