Howto make large iptables firewall rulesets scale under Linux.
Presentation given at OpenSourceDays 2008 (and similar at Netfilter Developers Workshop 2008).
Exploring the Future Potential of AI-Enabled Smartphone Processors
Netfilter: Making large iptables rulesets scale
1. by Jesper Dangaard Brouer <jdb@comx.dk> Master of Computer Science ComX Networks A/S OpenSourceDays 2008 d.4/10-2008 ComX Networks A/S
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16. Perl - IPTables::SubnetSkeleton #!/usr/bin/perl use IPTables::SubnetSkeleton ; my @CIDR = (8, 16, 24); # prefix list my $name = "bw"; # Shortname for bandwidth my $table = " mangle "; # Use “mangle” table my $subnet_src = IPTables::SubnetSkeleton::new("$name", " src ", $table, @CIDR); # Connect subnet skeleton to build-in chain "FORWARD" $subnet_src->connect_to("FORWARD"); # Insert IP's to match into the tree $subnet_src->insert_element("10.2.11.33", " userchain1 "); $subnet_src->insert_element("10.2.10.66", " userchain2 "); $subnet_src->insert_element("10.1.2.42", " userchain3 "); $subnet_src->insert_element("10.1.3.123", " userchain3 "); # Remember to commit the ruleset to kernel $subnet_src->iptables_commit();
17.
18.
19.
20.
21.
22.
23.
24.
25.
26.
27.
28.
29.
30.
31.
32.
33.
34.
Notes de l'éditeur
TALK: First I'll focus on the routing performance issue I'll come back to slow rule changes later
(To solve the routing performance issue, I had to: Make traffic categorizing scale!) (reducing the lookup time from O(n) to O(log(n)))
(named skip-list search infrastructure by Thomas Jacob <jacob@internet24.de>) (In mainline, iptables version 1.4.1, git:2008-01-15) The runtime complexity is actually also affected by this &quot;bucket&quot; size concept. Thus, O(log(n/k) + k) where k is CHAIN_INDEX_BUCKET_LEN.
(In mainline: iptables ver.1.4.2-rc1, git: 2008-07-03)
![Who am I ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]](data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7)