postcd
Member
- Joined
- Jul 8, 2012
- Messages
- 27
- Points
- 8
Hello,
when one want to block lets say 100 000 entries in netfilter/iptables, i read somewhere that it can be problem regarding speed (slow).
I have not tried.
So i wanted to ask what is limiting factor for fast processing of the iptables rules in case blocklist is very long and if it can be somehow prevented. (example by using ramdisk or by doing work in RAM)
I read about ipset but had no opportunity and time to try it, in this case i am interested just in iptables without ipset.
Someone mentioned that restarting iptables with many rules can take minutes so here again interested to know how to dramatically reduce time while still having many iptables entries.
when one want to block lets say 100 000 entries in netfilter/iptables, i read somewhere that it can be problem regarding speed (slow).
I have not tried.
So i wanted to ask what is limiting factor for fast processing of the iptables rules in case blocklist is very long and if it can be somehow prevented. (example by using ramdisk or by doing work in RAM)
I read about ipset but had no opportunity and time to try it, in this case i am interested just in iptables without ipset.
Someone mentioned that restarting iptables with many rules can take minutes so here again interested to know how to dramatically reduce time while still having many iptables entries.
