CompTIA Linux+ XK0-006 (V8) Practice Question

The correct solution is to use ipset. ipset is a framework that allows for storing and matching against large collections of IP addresses, networks, MAC addresses, or port numbers efficiently. Unlike iptables chains, which process rules linearly, ipset uses indexed data structures like hash tables, which allows for extremely fast lookups (O(1) complexity), even with millions of entries. By creating a single hash:ip set to hold all the malicious IP addresses, the administrator can replace thousands of individual iptables rules with a single rule that matches against the set. This dramatically reduces CPU overhead and improves firewall performance.

• Using a custom iptables chain still involves a linear traversal of all the rules within that chain, so it does not solve the fundamental performance problem.
• Migrating to ufw and adding individual rules would result in the same performance bottleneck, as ufw is a front-end that would create a similar underlying ruleset in iptables or nftables.
• Using firewalld to add thousands of individual source IPs to a zone is also less efficient than using a dedicated ipset. The most efficient way to handle large blocklists in firewalld is to use an ipset and reference it in a rich rule.