On Wednesday 23 May 2012 17:53:39 Jan Engelhardt wrote: > What, never heard of iptables-restore? Atomic replace has been in > iptables since a long long time. Yes, now that a few more neurons have fired, I experimented with iptables- restore a while back. I tested iptables-restore alongside Smoothwall/Roadster's ipbatch (custom libiptc interface). I don't recall the system details exactly; the kernel would've been around 2.6.32 and iptables would've been around 1.4.8. SWE3's ipbatch program was generally 5% faster than iptables-restore. Nothing to write home about. The bigger deal was that both programs exhibited errors when I applied more than 14k-25k rules without a commit. As long as there was a commit every 14k-25k rules, I could enter well over 250k rules; IIRC, I entered more than 1M rules a time or two. Granted, not many systems have more than 14k rules. And I haven't tested newer versions of the software since. But I believe that 14k-25k limit was enough to prevent a larger table from being atomically replaced. N -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
