Re: Creating rules without the /sbin/iptables command?

["John A. Sullivan III" <john.sullivan@nexusmgmt.com>]

I use it all the time in the ISCS project -- just remember to use the -n
argument.  It is much, much faster.  However, you need to supply the
input file in the proper and not well documented format - John

On Wed, 2004-03-17 at 16:53, Victor Julien wrote:
> Hi Hendrik,
> 
> This might be a big improvement, but it leaves me with one possible 
> problem. When adding and removing rules on-the-fly i can't use this 
> method, right?
> 
> Wouldn't it be nice if there was an c function which i could call, which 
> would do all the checking and other stuff the commandline iptables does, 
>   but, because its a c-function, way faster? Would it be easy (or even 
> possible) to implement such a function?
> 
> Regards,
> Victor
> 
> Henrik Nordstrom wrote:
> > On Wed, 17 Mar 2004, Cedric Blancher wrote:
> > 
> > 
> >>Le mer 17/03/2004 à 19:46, Victor Julien a écrit :
> >>
> >>>My program (written in c) creates rules by opening a pipe to 
> >>>/sbin/iptables. However this is quite slow with large rulessets and on 
> >>>slow hardware. Is there another way, like an iptables librarycall or 
> >>>something?
> >>
> >>You could use iptables libs that stand in /usr/lib/iptables, just like
> >>iptables does.
> > 
> > 
> > Or actually the preferred interface for this type of operations is to use 
> > iptables-restore, the batch version of iptables. The speed difference from 
> > using iptables-restore and direct calls is pretty minimal by any means.
> > 
> > libiptc is an internal interface of the iptables source tree and is
> > subject to change at any time. This should not be used directly unless you 
> > have very good reasons.
> > 
> > Regards
> > Henrik
> > 
-- 
John A. Sullivan III
Chief Technology Officer
Nexus Management
+1 207-985-7880
john.sullivan@nexusmgmt.com