Hi, > > > Since in this scenario userspace is able to determine ppp vs pptp, > > > could you not also do something like have an inbound_ppp and > > > inbound_pptp chain, then jump to the appropriate chain depending on > > > type? If you need per-interface rules, then create an inbound_pppX > > > chain, populate it with rules, then jump to that chain if -i pppX. In > > > ip-down, just delete the chain as well as the jump. > > > > if I understood Balazs correctly, one of the things he wanted to > > avoid is addition/deletion of iptables rules on every pppX interface > > up/down > > Exactly.
We faced a similar problem: we wanted to not only differentiate between ppp and pptp interfaces but even between different providers connected via ppp and pptp. We ended up predefining all possible providers in the rules and differentiate between them using the ipt_condition module. This module is not very well-loved in the netfilter community but there are usecases like this where it comes in handy. Maybe this is a solution for you too. > > as this would require the complete chain (say, INPUT or > > OUTPUT) to be "downloaded" to userspace, modified and then again > > "uploaded" to the kernel. At least until iptables redesign to > > allow replacement/insertion/deletion of single rules is completed > > which if started at all will take quite some more time :-) > > Iptables operates on a per-table basis, so it is not only the INPUT or > OUTPUT chain that needs to be down and uploaded, but the whole filter > table. The problem with the current solution is not only speed and maintainability but also locking: if two device up/down events happen at the same time in this scenario, the tabels will become wrong until you develop some kind of userspace locking. Kind regards, Gerd - To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html
