Loding rules

Loding rules

[nedco]

Hi,
 How to load fast about 20000 rules in iptables.
 If some document will be help , please let me know  :)

Thanks a lot
Nedco

Loding rules

[nedco]

Hi,
 How to load fast about 20000 rules in iptables.
 If some document will be help , please let me know  :)

Thanks a lot
Nedco

Re: Loding rules

[Roberto Nibali]

> Hi,
>  How to load fast about 20000 rules in iptables.
>  If some document will be help , please let me know  :)

Netfilter is not designed for that. Please use the nf-hipac[1] drop-in 
replacement. NF-hipac will do the filtering and rule organisation for you and 
for the rest (NAT, mangle) you can still use netfilter. Also you should check if 
you can't logically draw a binary tree with your rules which would then result 
in faster matching lookup (at least with netfilter).

And no: iptables-save/restore is _not_ an option for dynamically changing rules!

If you have that many rules you certainly have a logic or kind of a matrix 
behind that. Try to use some algebraic transformations (linear translation, 
Laplace (define network flows), Gauss, TSP, ...) to optimize the ruleset. I have 
done this and successfully reduced the number of rules.

[1] http://www.hipac.org

Regards,
Roberto Nibali, ratz
-- 
echo '[q]sa[ln0=aln256%Pln256/snlbx]sb3135071790101768542287578439snlbxq' | dc

Re: Loding rules

[Joel Newkirk]

On Wednesday 11 December 2002 01:12 pm, nedco@unacs.bg wrote:
> Hi,
>  How to load fast about 20000 rules in iptables.
>  If some document will be help , please let me know  :)
>
> Thanks a lot
> Nedco

As long as you don't need to dynamically define the rules (IE using a 
dynamic IP) iptables-save and iptables-restore should be your simple 
answer.  Oscar's tutorial explains save and restore at: 
http://iptables-tutorial.frozentux.net/chunkyhtml/saveandrestore.html

These will load the complete ruleset in a very few operations, instead of 
about 40000.  (based on your 20000 figure above)

j