Allow subnet notation (i.e xxx.xxx.xxx.xxx/24) in permanent ban strings

[ravetroll]

I noticed a lot of bans on individual ip address coming from a /24 subnet. I would like to be able to enter a wildcard ban on a subnet to permanent bans but it is not currently possible as the wildcard is not a valid ip address

[devnulli]

we must stick to what the windows advanced firewall can do. wildcards, it cannot. but i will add support for ip ranges like 192.168.0.0/24 to the ban list

[JReming85]

Off topic but would love to see dynamic/fqdn whitelists. Been using a script + cron to parse some of my ACL lists to read a fqdn and convert it to ip while updating it if it changes every so often.

Just not sure how much of an extra load that would introduce

[devnulli]

heres an interesting thing:

https://social.msdn.microsoft.com/Forums/ie/en-US/32614b57-f3a3-437f-a659-4777f5e6bd68/windows-firewall-limits?forum=wfp

they ARE talking about performance degradation when you significantly boost the numbers up, for example, when you roll out a * into ips

they DONT say where that number lies though

[JReming85]

Yea depending on version can be anywhere between 500-1000 per rule

[ravetroll]

Does this mean that EvlWatcher cannot push more than 1000 addresses into its block list? Mine currently has 1543 permanent bans?

[JReming85]

Thats per rule, there is no limit to what EvlWatcher an block just how fast your system can read all the rules it creates.

[ravetroll]

There is only 1 EvlWatcher rule in my system. Its in Inbound Rules and called EvlWatcher.

[devnulli]

it can push UNIT32 filters per rule (the banned ips) and UINT64 rules (1 rule called Evlwatcher).

to practically, theres no real limit. ill make a load test because im curious though haha

[foxontherock]

I think an option to always add ban to subnet .0/24 by default, instead of a specific IP, can be interesting. Lots of my permanently banned IPs are from the same subnet.