From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Florian Westphal <fw@strlen.de>
Cc: Arturo Borrero Gonzalez <arturo@debian.org>,
Netfilter Development Mailing list
<netfilter-devel@vger.kernel.org>
Subject: Re: using nft & iptables nat in parallel
Date: Wed, 14 Jun 2017 19:44:05 +0200 [thread overview]
Message-ID: <20170614174405.GA7395@salvia> (raw)
In-Reply-To: <20170614171312.GA7062@salvia>
On Wed, Jun 14, 2017 at 07:13:12PM +0200, Pablo Neira Ayuso wrote:
> On Wed, Jun 14, 2017 at 01:53:38PM +0200, Florian Westphal wrote:
> > Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> >
> > > The extra hook has a performance impact though, is it something that
> > > would just go away one x_tables is gone? What is your plan on this?
> >
> > Once we do it we can't remove it again, because you can have multiple
> > nat base chains after this change, and removing hook and merging it back
> > into the l3 nat code means first chain attaches a null binding again.
>
> With multiple nat chains, in case of overlap, we would just take the
> last coming in the pipeline. Just like several chains several times
> the same packet from a filter chain, right?
I meant: just like marking the packet several times from different
chains.
next prev parent reply other threads:[~2017-06-14 17:44 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-06-14 9:24 using nft & iptables nat in parallel Florian Westphal
2017-06-14 9:37 ` Arturo Borrero Gonzalez
2017-06-14 9:58 ` Florian Westphal
2017-06-14 10:40 ` Pablo Neira Ayuso
2017-06-14 11:19 ` Florian Westphal
2017-06-14 11:29 ` Pablo Neira Ayuso
2017-06-14 11:53 ` Florian Westphal
2017-06-14 17:13 ` Pablo Neira Ayuso
2017-06-14 17:44 ` Pablo Neira Ayuso [this message]
2017-06-14 18:00 ` Florian Westphal
2017-06-14 13:22 ` Arturo Borrero Gonzalez
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170614174405.GA7395@salvia \
--to=pablo@netfilter.org \
--cc=arturo@debian.org \
--cc=fw@strlen.de \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.