Re: Iptables rules processing

[Grant Taylor <gtaylor@riverviewtech.net>]

On 08/03/07 12:34, Rob Sterenborg wrote:
> This would IMHO only be of real use if you have lots of rules and you 
> want to narrow down the number of rules to be matched.

Agreed.  This is an example of how to optimize the packet flow through
the IPTables chains and rules.  Really it comes down to how many
decisions have to be made for any given packet and trying to rearrange
the chains and rules for optimal packet flow.  Rules are processed
serially / linearly / one by one / (what ever you want to call it) with
in a chain, so the idea is to reduce the number of individual rules and
the complexity there is to make packet traversal as fast as possible.

> In this case you won't notice the difference.

Presuming that the rules that we saw were the only rules in the OPs rule
set I'll agree.  However if there were 10s to 100s to 1000s (or more) of
these sets of rules, then the OPs rule set could very likely benefit
from optimization.  Depending on the number of rules it may be very much
worth the time to split a /24 block in to multiple smaller blocks.



Grant. . . .