From: "MauroTablo'" <m.tablo@libero.it>
To: <netfilter-devel@lists.netfilter.org>
Subject: netfilter efficiency
Date: Thu, 20 Jan 2005 18:56:04 +0100 [thread overview]
Message-ID: <005c01c4ff19$508ade80$c0de623e@MAURO> (raw)
Hi all.
My Linux (+ iptables) based firewall has about 90 forward filtering rules, for tcp packets (about 30 rules), udp datagram (about 40 rules) and icmp messages(about 20 rules).
Suppose that it comes a transit tcp packet that doesn't match anyone of my rules. So, the last rule will be applied, because it is the first one that matches the packet (/sbin/iptables -A FORWARD -j DROP)
The question is: iptables confronts the TCP packet with all my 90 rules, or it confronts the packet ONLY WITH rules for tcp packets (-p tcp)?
In other words, is there a function in netfilter that looks up to the protocol type of a transit packet and decides which rules to confront the packet with?
Thank you.
Mauro.
next reply other threads:[~2005-01-20 17:56 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2005-01-20 17:56 MauroTablo' [this message]
2005-01-21 13:30 ` netfilter efficiency Peter Surda
2005-01-21 13:39 ` Samuel Jean
2005-01-21 13:42 ` Sven-Haegar Koch
2005-01-21 19:35 ` Maxime Ducharme
2005-01-22 10:12 ` Jan Du Caju
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='005c01c4ff19$508ade80$c0de623e@MAURO' \
--to=m.tablo@libero.it \
--cc=netfilter-devel@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.