From: Philip Craig <philipc@snapgear.com>
To: Laszlo Attila Toth <panther@balabit.hu>
Cc: netdev@vger.kernel.org, netfilter-devel@vger.kernel.org
Subject: Re: [PATCH 0/2] Interface groups
Date: Tue, 16 Oct 2007 18:50:17 +1000 [thread overview]
Message-ID: <47147B49.706@snapgear.com> (raw)
In-Reply-To: <1192521703479-git-send-email-panther@balabit.hu>
Laszlo Attila Toth wrote:
> Hello,
>
> Different network interfaces can be grouped using the same group ID. With this
> patch fewer netfilter rules are necessary but it may also be used by routing.
This allows an interface to belong to only one group. I expect there are
situations where you want more. eg you might want a group of all pptp
connections, and another group of pptp connections for a subset of users.
An alternative approach would be to extend ipset to have sets of ifindex,
although this would tie it closer to iptables, and it would be slower.
But it still gives the properties of reducing the number of iptables rules,
and allowing to change group membership without reinstalling rules.
Maybe Jozsef has designed nfset to be able to handle this already?
next prev parent reply other threads:[~2007-10-16 8:45 UTC|newest]
Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <ifgroup.20071015.1192520046.panther@balabit.hu>
2007-10-16 8:01 ` [PATCH 0/2] Interface groups Laszlo Attila Toth
2007-10-16 8:50 ` Philip Craig [this message]
2007-10-16 9:47 ` Laszlo Attila Toth
2007-10-16 8:01 ` Laszlo Attila Toth
[not found] ` <1824b3d462b1d85aaf33941cf082c4e018d5bff7.1192460167.git.panther@balabit.hu>
2007-10-16 8:01 ` [PATCH 1/2] Interface group: core (netlink) part Laszlo Attila Toth
2007-10-16 8:01 ` Laszlo Attila Toth
2007-10-16 8:34 ` Patrick McHardy
[not found] ` <661f8f2fdb86cc70bdefd12403ecb0eaa7cfadd6.1192460168.git.panther@balabit.hu>
2007-10-16 8:01 ` [PATCH 2/2] Interface group match - netfilter part Laszlo Attila Toth
2007-10-16 8:01 ` Laszlo Attila Toth
2007-10-16 8:30 ` Patrick McHardy
2007-10-16 9:46 ` Laszlo Attila Toth
2007-10-16 14:46 ` Jan Engelhardt
2007-10-17 9:08 ` Laszlo Attila Toth
2007-10-17 9:11 ` Patrick McHardy
[not found] ` <a6713ba13c49b7fa20073d8abf1862480c2799e0.1192457385.git.panther@balabit.hu>
2007-10-16 8:01 ` [IPROUTE2 PATCH] Interface group as new ip link option Laszlo Attila Toth
2007-10-16 8:01 ` Laszlo Attila Toth
2007-10-16 8:38 ` Patrick McHardy
2007-10-16 9:33 ` Laszlo Attila Toth
2007-10-16 9:03 ` Resend: " Laszlo Attila Toth
2007-10-16 9:03 ` Laszlo Attila Toth
2007-10-16 9:11 ` Patrick McHardy
2007-10-16 10:45 ` jamal
2007-10-16 11:05 ` Laszlo Attila Toth
2007-10-16 11:26 ` jamal
2007-10-16 11:47 ` Laszlo Attila Toth
2007-10-16 12:08 ` jamal
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=47147B49.706@snapgear.com \
--to=philipc@snapgear.com \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=panther@balabit.hu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).