stop/start iptables vs. "iptables-restore"
Hi folks,
We run a linux based product (RHEL4 based, kernel-2.6.9-55, and iptables-1.2.11). During the running of the product, when we make changes to the iptables configuration, we use the SysV-like RHEL script "/etc/init.d/iptables restart", which effectively stops iptables, unloads all of the iptables based kernel modules, then starts iptables and all the kernel stuff.
A colleague recently asked why we're not using "iptables-restore" instead of the script which does "stop/start". I'm looking to see if you know of any reasons why we should or should not use iptables-restore vs. "stop/start". Does it matter if the number of connections on the system is high? Our product can sometimes handle many millions of connections per day.
Thanks.
...alex...
Quoted 16 lines · Alex Tang
Hi folks,
We run a linux based product (RHEL4 based, kernel-2.6.9-55, and iptables-1.2.11). During the running of the product, when we make changes to the iptables configuration, we use the SysV-like RHEL script "
/etc/init.d/iptablesrestart", which effectively stops iptables, unloads all of the iptables based kernel modules, then starts iptables and all the kernel stuff.A colleague recently asked why we're not using "iptables-restore" instead of the script which does "stop/start". I'm looking to see if you know of any reasons why we should or should not use iptables-restore vs. "stop/start". Does it matter if the number of connections on the system is high? Our product can sometimes handle many millions of connections per day.
Quoted 5 lines
Thanks.
...alex...
There is a dramatic difference in the time it takes to load the rules and rule changes. In the ISCS network security management project
(http://iscs.sourceforge.net), we frequently generate rule sets in the tens of thousands of rules and rule change sets in the thousands of rules to implement micro-partitioned, highly granular security. We found using just iptables was a showstopper.
Thus, ISCS not only loads its boot rule set using iptables-restore but even makes dynamic changes by writing an iptables-restore rule file and loading it via iptables-restore -n.
Hope that helps - John
Signature · 7 lines
John A. Sullivan III Open Source Development Corporation +1 207-985-7880 [email protected] Financially sustainable open source development http://www.opensourcedevel.com
Quoted 4 lines · Alex Tang
Hi folks,
We run a linux based product (RHEL4 based, kernel-2.6.9-55, and iptables-1.2.11). During the running of the product, when we make changes to the iptables configuration, we use the SysV-like RHEL script "
/etc/init.d/iptablesrestart", which effectively stops iptables, unloads all of the iptables based kernel modules, then starts iptables and all the kernel stuff. A colleague recently asked why we're not using "iptables-restore" instead of the script which does "stop/start". I'm looking to see if you know of any reasons why we should or should not use iptables-restore vs. "stop/start". Does it matter if the number of connections on the system is high? Our product can sometimes handle many millions of connections per day.
The RHEL start/stop scripts do use iptables-save and -restore. They are as efficient as they can be.
HTH,
M4