On 10-07-27 11:12 PM, Jan Engelhardt wrote:
On Wednesday 2010-07-28 03:17, Payam Chychi wrote:
it's much less and actually recommended than running all rules in
default/less chains as each pkt must traverse the entire chain to be
processed
Packets need not traverse an entire chain! All of -j ACCEPT, -j DROP,
-j RETURN and -g xxx cause an early exit from the current chain in one
way or another.
a packet must traverse an entire chain unless it meets a given condition
and as such its better to have more specific chains to jump packet
through rather than having to wait until the end of a chain, ie. 1000
line chain.
ps, my prevoius reply was suppose to say "its much less overhead to use
more chains and actually NOT recommended to run all rules in
default/less chains", sorry for the confusion.
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
