Re: iptables user space performance benchmarks published

[Phil Sutter <phil@nwl.cc>]

Hi Harald,

On Mon, Jun 22, 2020 at 03:34:24PM +0200, Reindl Harald wrote:
> Am 22.06.20 um 14:42 schrieb Pablo Neira Ayuso:
> > Hi Phil,
> > 
> > On Fri, Jun 19, 2020 at 04:11:57PM +0200, Phil Sutter wrote:
> >> Hi Pablo,
> >>
> >> I remember you once asked for the benchmark scripts I used to compare
> >> performance of iptables-nft with -legacy in terms of command overhead
> >> and caching, as detailed in a blog[1] I wrote about it. I meanwhile
> >> managed to polish the scripts a bit and push them into a public repo,
> >> accessible here[2]. I'm not sure whether they are useful for regular
> >> runs (or even CI) as a single run takes a few hours and parallel use
> >> likely kills result precision.
> > 
> > So what is the _technical_ incentive for using the iptables blob
> > interface (a.k.a. legacy) these days then?
> > 
> > The iptables-nft frontend is transparent and it outperforms the legacy
> > code for dynamic rulesets.
> 
> it is not transparent enough because it don't understand classical ipset

It does! You can use ipsets with iptables-nft just as before. If your
experience differs, that's a bug we should fix.

> my shell scripts creating the ruleset, cahins and ipsets can be switched
> from iptables-legacy to iptables-nft and before the reboot despite the
> warning that both are loaded it *looked* more or less fine comparing the
> rulset from both backends
> 
> i gave it one try and used "iptables-nft-restore" and "ip6tables-nft",
> after reboot nothing worked at all

Not good. Did you find out *why* nothing worked anymore? Would you maybe
care to share your script and ruleset with us?

> via console i called "firewall.sh" again wich would delete all rules and
> chains followed by re-create them, no success and errors that things
> already exist

That sounds weird, if it reliably drops everything why does it complain
with EEXIST?

> please don't consider to drop iptables-legacy, it just works and im miss
> a compelling argument to rework thousands of hours

I'm not the one to make that call, but IMHO the plan is for
iptables-legacy to become irrelevant *before* it is dropped from
upstream repositories. So as long as you are still using it (and you're
not an irrelevant minority ;) nothing's at harm.

Cheers, Phil