NetFilter
[Top] [All Lists]

Rule Optimization for iptables

To: netfilter@lists.netfilter.org
Subject: Rule Optimization for iptables
From: Arnd-Hendrik Mathias <arnd-hendrik.mathias@nefkom.net>
Date: Sat, 17 Mar 2007 18:10:19 +0100
Delivered-to: sp-com-lists@consult.net
Delivered-to: netfilter-list1@securepoint.com
List-archive: </pipermail/netfilter>
List-help: <mailto:netfilter-request@lists.netfilter.org?subject=help>
List-id: General discussion and user questions <netfilter.lists.netfilter.org>
List-post: <mailto:netfilter@lists.netfilter.org>
List-subscribe: <https://lists.netfilter.org/mailman/listinfo/netfilter>, <mailto:netfilter-request@lists.netfilter.org?subject=subscribe>
List-unsubscribe: <https://lists.netfilter.org/mailman/listinfo/netfilter>, <mailto:netfilter-request@lists.netfilter.org?subject=unsubscribe>
Sender: netfilter-bounces@lists.netfilter.org
User-agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.13) Gecko/20060806
Hi everyone,
can anybody tell me, if there is a possibility to make iptables optimize its rulesets automatically? The situation is as follows: I use my "workstation" (Celeron 233MHz/128MB RAM) as gateway for two local networks to WAN. I keep my rulesets for different protocols and different scenarios well sorted in separate sections of multiple files. This looks like:

# Forward outgoing tcp-ftp connections from lan0 to wan
...ruleset...

# Forward outgoing tcp-ftp connections from lan1 to wan
...ruleset...

....a.s.o.

As a following of this I have some rules somewhat redundant and others could be combined to one with the similar effect. I could easily reduce the number of rules to be checked (hoping to reduce the processing time/RAM usage of iptables) manually by combining many rules but this would make my rulesets less maintainable. Currently it's quite easy to spontaneously block for example outgoing https sessions from lan1 by simply commenting out the corresponding few rules without side effects to other protocols. So a means to optimize the ruleset already loaded could be quite helpful for easy administration.
Has anyone heard of such stuff?
Best regards

Arnd-Hendrik


<Prev in Thread] Current Thread [Next in Thread>
  • Rule Optimization for iptables, Arnd-Hendrik Mathias <=