Optimize netfilter's Performance Using
If you write a lot of similar rules based on mere IP, port, or both, consider using
ipset to optimize netfilter's performance.
iptables -s 192.168.1.11 -j ACCEPT
iptables -s 192.168.1.27 -j ACCEPT
iptables -s 192.168.1.44 -j ACCEPT
... hundreds of similar rules ...
iptables -s 192.168.251.177 -j ACCEPT
This means that a packet with the source address of 192.168.251.177 must first traverse hundreds of rules before it can get its verdict of ACCEPT.
Of course, experienced sysadmins will split the rules by subnet. But that still means hundreds of rules.
ipset to the rescue!
First, define an IP Set of
ipset -N Allowed_Hosts ipmap --network 192.168.0.0/16
Then, populate it with the addresses:
for ip in $LIST_OF_ALLOWED_IP; do ipset -A Allowed_Hosts $ip; done
Finally, replace the hundreds of iptables rules above with one rule:
iptables -m set --match-set Allowed_Hosts src -j ACCEPT
When a packet arrives, netfilter will perform a very quick bitmap search for the packet's source (src) IP against the
Allowed_Hosts IP Set. All packets coming from 192.168.0.0/16 will experience one rule. And do believe me that searching a bitmap is at least two order of magnitudes faster than performing hundreds of iptables rule-checking.
ipset is not limited to IP addresses. It can also match based on ports, IP-port tuple, network/subnet addresses, IP-MAC tuple, and so on and so forth. And it can match those criteria as source or destination or a mix of both (in the case of tuples).
And finally, with
ipset you can automatically put IP addresses in blacklists/whitelists. These blacklists/whitelists can also 'age', thus automatically deleting the IP address after a configurable amount of time has passed.
Please refer to
ipset's man page for more details.
VERY IMPORTANT NOTE:
Some Linux distros do not have 'out-of-the-box' support for ipset. Two distros I know that do not support ipset out-of-the-box are Ubuntu and Debian. Running
aptitude on them tantalizingly shows that an
ipset package is available, but I strongly recommend you to not install that package for two reasons: (1) It's an old version of ipset, and (2) It won't work anyway.
ipset's source from its website: http://ipset.netfilter.org/install.html
Alternatively, if you use
xtables-addons, ipset is included in its source: http://xtables-addons.sourceforge.net/
Edit: The above is true for Ubuntu 10.04, the latest LTS at the time of writing. Ubuntu 12.04 has built-in support for
xtables-addons, in the sense that installing the relevant package properly enables the features. I don't know the situation on Debian, though, having not used it for quite some time...