Optimization of Linux soft firewall ACL matching

Optimization of Linux soft firewall ACL matching

First, the request should not be framed by Netfilter! Although it has some inherent performance loss, please do not equate iptables with Netfilter. If you want to catch the culprit, please say iptables directly, rather than Netfilter!

Iptables is really weak! Its ipt_do_table is one of the five major culprit. If the rule exceeds 7000, it is the first (other culprit is the nf_conntrack function, which is also the HOOK of Netfilter ). The reason iptables is inefficient is that its ACL rules are not pre-processed, and the way and sequence configured by humans are used to match packets one by one, in the Linux protocol stack, the route table is not converted into a forwarding table, and the maximum prefix matching is directly performed for the data packets! This is not a Linux error, nor a Netfilter error, but your error. Why don't you try to use or modify nf-HiPAC?

ACL element matching can be divided into "and" and "or". It is generally considered that the operation is performed in the same rule, and the operation or operation represents a different rule, such as the following rule:

Iptables-a forward-d $ ip1-p tcp-j DROP

Iptables-a forward-d $ ip2-p udp-j DROP

Among them, ip1 and tcp, ip2 and udp are and operations, while the two rules are or operations. If we group them, we will get that the same group needs to be serialized, conclusions about parallel operations for different groups.

If we pre-process the two rules and re-reverse grouping, can we regroup them based on matching elements instead of rules? This is justified because the number of matching elements is fixed, while the number of rules is not fixed, we must execute fast search algorithms between massive elements instead of sequential traversal matching algorithms. Therefore, massive elements cannot be serialized as the same group of elements. In the process of ACL matching, both traversal and quick search are required (as mentioned earlier, same-group serial-only traversal, parallel-any algorithm can be executed ), however, you must remember not to divide rules into a group according to rules, but to use matching elements as the group benchmark. You must know that human understanding is totally different from computer processing, or even the opposite.

Most Firewall Products (Cisco and Huawei do not mention that XXWRT has similar patches, maybe? Well, it seems to be true. Although I didn't know each other, I just guessed it ...) all the ACL Rule chains that are manually typed are pre-processed. This is actually a method of nf-HiPAC. I have written several related articles before. Linux iptables does not have any preprocessing, which is the cause of its inefficiency. However, this inefficiency cannot be attributed to Linux or Netfilter.

-------------------------------------- Split line --------------------------------------

Disable the default firewall in CentOS 7.0 and enable the iptables firewall.

Iptables examples

Linux Firewall iptables

Basic use of iptables backup, recovery, and firewall scripts

Detailed description of firewall iptables usage rules in Linux

-------------------------------------- Split line --------------------------------------

This article permanently updates the link address: