On 2012-08-24 19:46, Jan Engelhardt wrote:
On Friday 2012-08-24 23:12, Arturo Borrero wrote:
You usally set your ruleset in this way:
$IPT -A INPUT -i $IF -s $INTERNET -d $MYSERVER -p tcp --sport 1024:
--dport
$SSH_PORT -j ACCEPT
If you begin with something like this, no wonder it's all going slow,
because you are needlessy reloading all the damn rules.
That's why smart people use iptables-restore.
Oh, only about ~2000 times faster in my tests :p
http://www.slideshare.net/slideshow/embed_code/14051936?startSlide=22
--
Julien Vehent - http://jve.linuxwal.info
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
