it's much less and actually recommended than running all rules in default/less chains as each pkt must traverse the entire chain to be processed Regards, -- Payam Tarverdyan Chychi Network Engineer Sent from my iPhone On 2010-07-27, at 5:23 PM, Jonathan Tripathy <jonnyt@xxxxxxxxxxx> wrote: > Hi Everyone, > > I wish to use iptables on a host that will be hosting a large number of VMs for customers. IPtables will do some basic "managed firewalling" for them. > > My question is, how expensive are having lots of custom chains? My idea is to create one child chain per VM, with the idea to cut down the amount of rules evaluated (i.e. a parent chain would only jump to a child chain if the dest IP matches) - does this sound like a good idea? > > Thanks > -- > To unsubscribe from this list: send the line "unsubscribe netfilter" in > the body of a message to majordomo@xxxxxxxxxxxxxxx > More majordomo info at http://vger.kernel.org/majordomo-info.html -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
