Currently banned / Banned IP list: limit? (how many can I have?)

[drankinatty]

All,

I've looked but cannot find a max for the number of Currently banned / Banned IP list entries. I suspect that it is much more than the 55 IP that are currently banned in the dovecot jail, but I want to confirm this in case it is something small like an 8-bit value, etc.. that I may hit after going to a stateful setup with fail2ban. I have a 2d bantime set and I could easily see hitting 150 or so jailed during that 2d period.

Does anybody know off-hand or can you point me to where in the source I would need to look to find it?

[sebres]

Fail2ban itself has no restrictions by ban count directly (well, generally, by the the used memory only). But some action may have it due to default settings, e.g. for iptables-ipset it is 65536 IPs per jail by default.
See #3549 and #3564 for details or how one could re-configure it.

[drankinatty]

So fail2ban allocates and iptables has a 16-bit per jail limit. Exactly what I needed to know. I'll never get there -- that was my main concern. I didn't just want to assume, so your help is greatly appreciated.

[sebres]

No. Neither iptables has a limit (I spoke about ipset)… nor it is directly a limit of ipset - it is simply a default hash size.
If you use iptables (without ipset) or nftables actions, they don't really have a limit.
And I also already wrote how one can configure larger set-size for *-ipset.

[drankinatty]

My bad. I just have iptables and fail2ban. So that is even better news. Sorry I misunderstood the 65536 implication.

[sebres]

Well, having 64k IPs or even more in any chain of iptables is not good idea (meant as a single rule per IP how iptables-action would do). The filtering throughput will go down already by few thousands rules. Especially if one have many jails (chains) over the same conditions (all ports or equivalent ports, etc), the amount considered by filtering equals all rules in affected jails.
See this comparison.
Therefore if one expects a large amount of bans, better will be ipset or nftables based actions.

You can also enable bantime.increment and small initial bantime with plausible bantime.maxtime to reduce amount of sporadic or non-recidive bans (which never come back). See #3152 (comment) for similar discussion.