Hi, On Thu, Jan 13, 2005 at 05:45:34PM -0500, henry wrote: > I am curious what is the maximum number of iptable rules that can be > installed in a config before performance starts to be a problem. I have > looked into the possibility of using firewall rules to block "bad" > networks, but I have been told by most people that I have asked that > this is bad idea. > > Here are my thoughts. If a packet matches the 3rd rule, does it matter > if there are 100,000 rules below it? 1,000,000 rules below it? If it > doesn't, then does the number of allowable rules really have to do with > how intelligently the rules are written, and more specifically, in what > order? If you want to deal with large rule sets and/or high bandwidth you should definitely consider hipac (http://www.hipac.org) Quoted from the hipac web-site: iptables, like most packet filters, uses a simple packet classification algorithm which traverses the rules in a chain linearly per packet until a matching rule is found (or not). Clearly, this approach lacks efficiency. As networks grow more and more complex and offer a wider bandwidth linear packet filtering is no longer an option if many rules have to be matched per packet. Higher bandwidth means more packets per second which leads to shorter process times per packet. With nf-HiPAC we offer a novel framework for packet classification which uses an advanced algorithm to reduce the number of memory lookups per packet. It is ideal for environments where large rulesets and/or high bandwidth networks are involved. Thereby, the iptables' semantics of the rules is preserved, i.e. you can construct your rules like you're used to. From a user's point of view there is no need to understand anything about the HiPAC algorithm. At the hipac site you will find a comparison with iptables. The central firewall of our university ( http://www.kuleuven.ac.be/english/ ) uses hipac and we are very pleased with it. At the moment there is only an implementation for a 2.4 kernel but the developers are working on a 2.6 version :-) Hope this helps, Jan --------------------------------------------------- KULeuvenNet ------- Jan.DuCaju@xxxxxxxxxxxx http://www.kuleuven.net/e_index.html K.U.Leuven http://www.kuleuven.ac.be/english/ LUDIT - KULeuvenNet http://ludit.kuleuven.be/index_en.html de Croylaan 52A 3001 Leuven Belgium -----------------------------------------------------------------------
