Re: [patch] RFC: matching interface groups

[Balazs Scheidler <bazsi@balabit.hu>]

On Tue, 2006-08-01 at 21:18 +0200, Sven Schuster wrote:
> Hi Phil,
> 
> On Tue, Aug 01, 2006 at 11:46:55AM -0700, Phil Oester told us:
> > Since in this scenario userspace is able to determine ppp vs pptp, 
> > could you not also do something like have an inbound_ppp and inbound_pptp
> > chain, then jump to the appropriate chain depending on type?  If you
> > need per-interface rules, then create an inbound_pppX chain, populate
> > it with rules, then jump to that chain if -i pppX.  In ip-down, just
> > delete the chain as well as the jump.
> 
> if I understood Balazs correctly, one of the things he wanted to
> avoid is addition/deletion of iptables rules on every pppX interface
> up/down 

Exactly.

> as this would require the complete chain (say, INPUT or
> OUTPUT) to be "downloaded" to userspace, modified and then again
> "uploaded" to the kernel. At least until iptables redesign to
> allow replacement/insertion/deletion of single rules is completed
> which if started at all will take quite some more time :-)

Iptables operates on a per-table basis, so it is not only the INPUT or
OUTPUT chain that needs to be down and uploaded, but the whole filter
table.

And in addition, in my humble opinion the iptables ruleset should be up
to the user to maintain, once some kind of automatism starts to
add/remove rules on the fly, it becomes more difficult to do other
changes to add independent rules to the table. For example the user
needs to save the current ruleset using iptables-save, then modify the
resulting file, and then load it again. If the ruleset is generated as
it happens with a lot of tools, this might not be so easy.

-- 
Bazsi