iptables

dunkyb · 02-16-2003, 04:30 PM

Hey

Is it best to compile all the iptables/NAT/Netfilter stuff into the kernel, or build it as modules? I guess they'll be used a lot, so will be loaded...

Are there any performance boosts/preferences either way?

Cheers

fsbooks · 02-16-2003, 05:15 PM

My preference is to build any and everything as a module (including iptables) if it can be done so (option exists and not needed too early at boot, like my scsi driver). Then again, I am a bit wierd because I write all my kernels to floppy, and actually boot from a floppy. So for me, I suppose it certainly is a performance issue, even a usability issue as today's kernels can easily exceed a floppy with too many options compiled in.

acid2000 · 02-16-2003, 06:59 PM

module, unless it's needed at startup or within the first 10 seconds of loading init, module.

dunkyb · 02-16-2003, 07:04 PM

actually there is a way (using bootinitrd?) that you can make modules work for booting the machine, but anyways..

Another question, is the arp_tables code implimented yet? It doesn't seem to do a great deal, so I am going to remove it from my kernel for the time being?

Any hints/tips from mega gurus on how to reduce kernel size to the min? (Without nuking the box!)

Cheers