Hello Michael, Agreed. If well designed, it will improve performance. But, what is the cost to send a packet to another chain? And if you have something like: iptables -A INPUT -i eth0 -p tcp -j C1 iptables -A C1 -p tcp --dport 22 -j C1_SSH iptables -A C1_SSH -s 192.168.0.2/32 -j ACCEPT iptables -A C1_SSH -s 192.168.0.7/32 -j ACCEPT iptables -A C1_SSH -s 192.168.0.23/32 -j ACCEPT When the packet arrives, and it's from 192.168.0.7, it will be handled by INPUT, then C1 and finally C1_SSH at the second rule. What I'm trying to discover is, what is the cost to send the packet from one chain to another. It's more easy to configure and maintain your rules with user-chains, but how much it will cost in performance, if instead of the above example, I use the following rules: iptables -A INPUT -i eth0 -p tcp --dport 22 -s 192.168.0.2/32 -j ACCEPT iptables -A INPUT -i eth0 -p tcp --dport 22 -s 192.168.0.7/32 -j ACCEPT iptables -A INPUT -i eth0 -p tcp --dport 22 -s 192.168.0.23/32 -j ACCEPT Regards! Alejandro Flores > Hello, > > Well I am not expert but I think that user chains could improve performance. If you had in total 1000 rules and no user > chains, a packet may have to go through 999 rules to find a match or no match. If you broke up your 1000 rules into 25 > different user chains a packet would at most have to be matched against 24 user chains and then only be checked against > required chains and not other rules. > > Michael. > > > On Tue, 13 Jul 2004 18:04:43 -0300 > Alejandro Flores <alejandro.flores@xxxxxxxxxxxxxxxx> wrote: > > > Hello there, > > > > Well, I've been teaching netfilter/iptables for a while, and always > > there's someone asking about performance. Normally, they use other kind > > of firewall, like cisco pix or checkpoint. Is there any benchmark out > > there? > > Another point is, how much user-chains can degrade the performance? > > IMHO, user chains are simple the best to help you organize and separate > > rules in groups. But, how can I measure if it's degrading the > > performance? > > > > Thanks! > > Alejandro > > > > Ps. Sorry my poor english! > > > > > > > > > > >
