Re: Creating rules without the /sbin/iptables command?

[Victor Julien <victor@nk.nl>]

Hi Hendrik,

This might be a big improvement, but it leaves me with one possible 
problem. When adding and removing rules on-the-fly i can't use this 
method, right?

Wouldn't it be nice if there was an c function which i could call, which 
would do all the checking and other stuff the commandline iptables does, 
  but, because its a c-function, way faster? Would it be easy (or even 
possible) to implement such a function?

Regards,
Victor

Henrik Nordstrom wrote:
> On Wed, 17 Mar 2004, Cedric Blancher wrote:
> 
> 
>>Le mer 17/03/2004 à 19:46, Victor Julien a écrit :
>>
>>>My program (written in c) creates rules by opening a pipe to 
>>>/sbin/iptables. However this is quite slow with large rulessets and on 
>>>slow hardware. Is there another way, like an iptables librarycall or 
>>>something?
>>
>>You could use iptables libs that stand in /usr/lib/iptables, just like
>>iptables does.
> 
> 
> Or actually the preferred interface for this type of operations is to use 
> iptables-restore, the batch version of iptables. The speed difference from 
> using iptables-restore and direct calls is pretty minimal by any means.
> 
> libiptc is an internal interface of the iptables source tree and is
> subject to change at any time. This should not be used directly unless you 
> have very good reasons.
> 
> Regards
> Henrik
>