Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a script maintaining gre tunnels and firewall rules using the "ip" and "iptables" tools. Setting up hundreds of tunnels, and adresses per interface runs just fine. Takes less than 0.1 second per interface, however when I get around to do the firewall rules everything slows down spending >0.5 per insertion.

Why is it running so slow? What can I do to improve the speed?

It seems like I could try ipset instead, but I really feel there is something wrong with the kernel or something. The interesting thing is that the first 10 rules runs fast, then it slows down..

mybox(root) foo# iptables -V
iptables v1.3.5
mybox(root) foo# uname -a 
Linux foo 2.6.18-164.el5 #1 SMP Tue Aug 18 15:51:48 EDT 2009 x86_64 x86_64 x86_64 GNU/Linux
mybox(root) foo# cat test.sh
#!/bin/sh

for n in {1..100}
do
  /sbin/iptables -A OUTPUT -s ${n} -j ACCEPT
  /sbin/iptables -D OUTPUT -s ${n} -j ACCEPT
done
mybox(root) foo# time ./test.sh

real    1m38.839s
user    0m0.100s
sys     1m38.724s

Appriciate any help. Cheers!

share|improve this question
    
Something may be screwy on your system. I tried running your test.sh in a Debian VM and it completes in 1.2s –  Zoredache May 5 '10 at 22:18
add comment

1 Answer

up vote 0 down vote accepted

Number one: Your kernel is very out-of-date. And so is your iptables.

Number two: The 'problem' is that for every invocation of iptables, what happened is:

  1. iptables pulls the whole table from kernel into userspace
  2. iptables modifies the table in userspace
  3. iptables pushes back the table into kernelspace

Rather, configure your iptables ruleset the way you want it, then save it using iptables-save > some_file_name. The whole ruleset will be restored in one fell swoop using the command iptables-restore < some_file_name.

(Of course, replace some_file_name there with the name of the file you want to save the ruleset in.)

share|improve this answer
    
It was actually a bug, and fixable by upgrading the kernel. However manging this many rules without ipsets was really slow even in the new kernel. So I ended up using ipset. –  Ole Jørgensen Oct 29 '12 at 8:56
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.