Steven Kath wrote:
Have you considered using netfilter's ip sets for this? Sounds like it
might be perfect for your needs.
http://www.netfilter.org/projects/ipset/
Yes, if it was right in the kernel (without patch-o-matic) I agree it
would be the way to go ;)
Jan Engelhardt wrote:
Each invocation of iptables retrieves and writes the rule table back
into the kernel, which is very antiperformant. You want to be using
iptables-restore here to minimize any delays.
You mean building a file and then using 'iptables-restore -n < file' ? I
will take a look at it. Thanks.
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
