Re: MAC Hash

["Gáspár Lajos" <swifty@freemail.hu>]

What about this?


iptables -t mangle -N PRE_BR1_MAC
cat /etc/firewall/mac_br1 | sort | grep '+' | while read line
 do
 iptables -t mangle -A PRE_BR1_MAC -j CONNMARK -m mac --mac-source `echo 
$line | awk '{print $1}'` --set-mark $MARK_KNOWN_MAC
 done
iptables -t mangle -A PRE_BR1_MAC -j RETURN -m connmark --mark 
$MARK_KNOWN_MAC

# UNKNOWN MAC !!!
iptables -A PRE_BR1_MAC -j LOG --log-prefix 'IPT: ***MAC BR1*** ' 
--log-level debug
iptables -A PRE_BR1_MAC -j DROP

# Only on BR1 !!!
iptables -t mangle -N PRE_BR1

# CHECK MAC
iptables -t mangle -A PRE_BR1 -j PRE_BR1_MAC -m connmark ! --mark 
$MARK_KNOWN_MAC
iptables -t mangle -A PRE_BR1 -j ACCEPT

iptables -t mangle -A PREROUTING -j PRE_BR1 -i br1



Swifty

Brian Austin - Standardknit írta:
>
> -----Original Message -----
> From: Jason Cosby
> Sent: 26/09/2008 8:18 AM
>> All,
>>
>> I have the following running on our server:
>>
>> for m in xx:xx:xx:xx:xx:xx...about 75 MACs
>> do
>>   iptables -t mangle -A PREROUTING -i eth1 -m mac --mac-source $m -j 
>> ACCEPT
>> done
>>
>> iptables -t mangle -A PREROUTING -i eth1 DROP
>>
>> iptables -t mangle -A PREROUTING -i eth1 -m iprange ! --src-range \
>>    192.168.1.1-192.168.1.74 -j DROP
>>
>> and encountered a noticable slowdown when I incorporated the above. 
>> Can anyone offer suggestions as to how to speed this up? I know that 
>> hash tables are out there, but I am not clear on their use.
>> Thanks,
>> Jason
>> -- 
>> To unsubscribe from this list: send the line "unsubscribe netfilter" in
>> the body of a message to majordomo@vger.kernel.org
>> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>>   
> I would suggest the problem is your chain of 75 rules...
>
> You may want to make some stubby user chains and branch the tests out, 
> so packets go thru less checks.
>
> ie 7 user chains, with 10 checks in each
>
> so the worst case for chain traversal would be around 17 rules 
> traversed, not 75, with an average of 8 rules, not 37....
>
> and put your busiest mac addresses at the top of the checks if you can.
>
> regards
>
> b
>
>
>
>
> -- 
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>
>