Iptables execution time

Iptables execution time

[Michele Petrazzo - Unipex srl]

Hi list,
I'm seeing that the execution of an iptables update via a shell script
take very different time into a my "in production" server and on my test
server. My script has about 1500 iptables commands and simple insert a
rule on a table.

On my in production server, it takes about 45 sec and on my test server 4!
My server are 2x Xeon 2.6GHz (so 4 cpus) with 2.6.26 on x86_64 SMP with
2GB ram and my test server amd  3000+ with 2.6.26 i686 1GB,

Can be that, on the production server that has a lot of connection it
take so lot of time due the connections (I try to say that it has to "lock"
the kernel before and "unlock" after an iptables add) or there can be some
problems?

Thanks,
Michele

P.s. Yes, I know that the same rules with iptables-restore on my test
server takes about 0.5 sec :)

Re: Iptables execution time

[Pablo Neira Ayuso]

Michele Petrazzo - Unipex srl wrote:
> Hi list,
> I'm seeing that the execution of an iptables update via a shell script
> take very different time into a my "in production" server and on my test
> server. My script has about 1500 iptables commands and simple insert a
> rule on a table.
> 
> On my in production server, it takes about 45 sec and on my test server 4!
> My server are 2x Xeon 2.6GHz (so 4 cpus) with 2.6.26 on x86_64 SMP with
> 2GB ram and my test server amd  3000+ with 2.6.26 i686 1GB,
> 
> Can be that, on the production server that has a lot of connection it
> take so lot of time due the connections (I try to say that it has to "lock"
> the kernel before and "unlock" after an iptables add) or there can be some
> problems?

I think that it's taking the time in forking and executing, but you can
do some profiling so we can stop speculating.

> P.s. Yes, I know that the same rules with iptables-restore on my test
> server takes about 0.5 sec :)

So, why don't you use that interface? :)

-- 
"Los honestos son inadaptados sociales" -- Les Luthiers

Re: Iptables execution time

[Michele Petrazzo - Unipex srl]

Pablo Neira Ayuso wrote:
> I think that it's taking the time in forking and executing, but you 
> can do some profiling so we can stop speculating.
> 

How do it? It's a "simple" script that repeater N times that same thing,
more or less (where N are ~1500)

And after, also if it's not a iptables-related question, why that so
time for do the fork and execute when It's, at least, two time faster
than the test one?

>> P.s. Yes, I know that the same rules with iptables-restore on my 
>> test server takes about 0.5 sec :)
> 
> So, why don't you use that interface? :)
> 


Why leave the right way for follow the new one that you don't know where
it'll bing you? :). Ok I'll take a look for update my script system!


Thanks,
Michele

Re: Iptables execution time

[Pablo Neira Ayuso]

John Bourke wrote:
> Folks,
> 
> I ran some tests tonight.  I took our usual firewall rule count of about
> 5000 rules and added another 25,000.  At every 100 added I measured the time
> taken to add the last of the 100.
> 
> After the first 100 rules, a rule was added in 29ms.  After 25,000 rules
> were added last the rule was added in 169ms.  The total number of rules at
> the end was 29716.
> 
> On another system, the 100th rule added in 40ms, the 25,000th rule added in
> 90ms, and the total rule count at the end was 32227.
> 
> The rule add was a simple 
> 
> iptables -I FORWARS -s 10.0.a.b -j ACCEPT
> 
> Where a was from 1 to 250 and b was from 1 to 100.  So I was not doing
> anything more complex.
> 
> Even at 40ms, I can only load 25 rules a second.  As I have a dynamic
> firewall which changes every second, and each of my users has about 25
> rules, I can only handle one user addition or removal a second.  I would
> like to do 10 per second, 250 rules per second.
> 
> Are there better ways to do this, iptables-restore, ipset ?

Use iptables-restore -n and pipe the rules updates for dynamic rule 
addition and deletion.

-- 
"Los honestos son inadaptados sociales" -- Les Luthiers