Rule Optimization for iptables

Rule Optimization for iptables

[Arnd-Hendrik Mathias]

Hi everyone,
can anybody tell me, if there is a possibility to make iptables optimize 
its rulesets automatically? The situation is as follows: I use my 
"workstation" (Celeron 233MHz/128MB RAM) as gateway for two local 
networks to WAN. I keep my rulesets for different protocols and 
different scenarios well sorted in separate sections of multiple files. 
This looks like:

# Forward outgoing tcp-ftp connections from lan0 to wan
...ruleset...

# Forward outgoing tcp-ftp connections from lan1 to wan
...ruleset...

....a.s.o.

As a following of this I have some rules somewhat redundant and others 
could be combined to one with the similar effect.
I could easily reduce the number of rules to be checked (hoping to 
reduce the processing time/RAM usage of iptables) manually by combining 
many rules but this would make my rulesets less maintainable. Currently 
it's quite easy to spontaneously block for example outgoing https 
sessions from lan1 by simply commenting out the corresponding few rules 
without side effects to other protocols. So a means to optimize the 
ruleset already loaded could be quite helpful for easy administration.
Has anyone heard of such stuff?
Best regards

Arnd-Hendrik