Re: iptables performance and alternatives

[Anton <anton.vazir@gmail.com>]

On Thursday 15 May 2008 16:18, Jan Engelhardt wrote:
> On Thursday 2008-05-15 12:57, Anton wrote:
> >Definitelly what my test shows - while rule-inserts - if
> > you try to insert 10000 rules - after a several
> > hundreds - it will be inserting like a 1 rule in 1
> > second and slowness will progress :)
>
> Your insertion slowness is probably due to incorrect use
> of iptables.

Possible too. 

But aside of use of IPMARK from xtables, if I have to match 
80  (prio traffic)  22(realtime) port for every customer IP 
and customer's ip too (bulk traffic) for another mark set 
and all with different htb queues - IPMARK will not help 
and in case of, say, 1000 matching IP's, it comes to 4 
queues per , with 3 to use with lending/borrowing (main, 
80, and 22) and 3000 queuses in total, plus POSTROUTING 
mangle rule per park (3000 rules) + 3000 return rules 
(6000) rules and so on. If this PC also do NAT for 
matches - it will come with extra 1000 rules (or single 
IPSET :)

If there is a better approach to this in relation to 
IPTABLES - this would be just great...