lkml.org 
[lkml]   [2005]   [Jan]   [31]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: Performance of iptables-restore on large rule sets
On Fri, Jan 28, 2005 at 12:56:30PM -0600, Steve Bergman wrote:
> I have a large rule set (~53000 rules) that I sometimes load using
> iptables-restore. (It takes almost an hour.

That's really slow. I've seen multiple minutes, but an hour? What kind
of system is this? How does the ruleset look like? Maybe some dns
resolvals are timing out?

> Googling around tells me that the loop detection code in the kernel is
> slow with large rule sets.

That's wrong. What used to be slow is libiptc. iptables-1.2.11 should
actually already be significantly faster than all prior versions.

Please try the current pre-1.3.0 snapshots from
ftp://ftp.netfilter.org/pub/iptables/snapshot

Please report back if they solve your performance issue.

> Steve Bergman
--
- Harald Welte <laforge@gnumonks.org> http://www.gnumonks.org/
============================================================================
"Privacy in residential applications is a desirable marketing option."
(ETSI EN 300 175-7 Ch. A6)
[unhandled content-type:application/pgp-signature]
\
 
 \ /
  Last update: 2005-03-22 14:10    [W:0.067 / U:0.372 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site