Re: [RFC] iptables namespaces

[Steven Van Acker <deepstar+NRpGDEuW@singularity.be>]

On Sat, Sep 08, 2007 at 09:26:09AM +0200, Jan Engelhardt wrote:
> >iptables-restore takes a file as input, not a series of iptables
> >commands.
> 
> Yes, it takes a file. And if you looked at it, yes, it takes iptables
> commands! (besides the table and counter markers)
> 
> >This means I would have to edit the file manually, not
> >something I want to do with 7000 firewall rules.
> 
> Where is the difference between...
> 
> 	iptables -A INPUT -m foobar -j FOOBAR
> 
> and adding
> 
> 	-A INPUT -m foobar -j FOOBAR
> 
> to the
> 
> 	*filter
> 
> section? (Otherwise, write a script, as suggested, or use a GUI ;-)

Hi,

it's remarkable that we have never tried it this way before.
I tested adding 10000 lines with iptables, then using iptables-save and
iptables-restore. The difference in speed is amazing. With iptables it
takes 5 minutes and 10 seconds, while iptables-restore takes 0.3
seconds.

Moreover, if there is an error in iptables-restore, none of the changes
are committed to kernelspace. So I no longer need to use fancy checking
while I'm loading my firewall rules.

Thank you both for the information :)

kind regards,
-- Steven