On Tue, 2006-08-01 at 21:18 +0200, Sven Schuster wrote: > Hi Phil, > > On Tue, Aug 01, 2006 at 11:46:55AM -0700, Phil Oester told us: > > Since in this scenario userspace is able to determine ppp vs pptp, > > could you not also do something like have an inbound_ppp and inbound_pptp > > chain, then jump to the appropriate chain depending on type? If you > > need per-interface rules, then create an inbound_pppX chain, populate > > it with rules, then jump to that chain if -i pppX. In ip-down, just > > delete the chain as well as the jump. > > if I understood Balazs correctly, one of the things he wanted to > avoid is addition/deletion of iptables rules on every pppX interface > up/down
Exactly. > as this would require the complete chain (say, INPUT or > OUTPUT) to be "downloaded" to userspace, modified and then again > "uploaded" to the kernel. At least until iptables redesign to > allow replacement/insertion/deletion of single rules is completed > which if started at all will take quite some more time :-) Iptables operates on a per-table basis, so it is not only the INPUT or OUTPUT chain that needs to be down and uploaded, but the whole filter table. And in addition, in my humble opinion the iptables ruleset should be up to the user to maintain, once some kind of automatism starts to add/remove rules on the fly, it becomes more difficult to do other changes to add independent rules to the table. For example the user needs to save the current ruleset using iptables-save, then modify the resulting file, and then load it again. If the ruleset is generated as it happens with a lot of tools, this might not be so easy. -- Bazsi - To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html
