Not logged in
Log in now
Create an account
Subscribe to LWN
LWN.net Weekly Edition for December 5, 2013
Deadline scheduling: coming soon?
LWN.net Weekly Edition for November 27, 2013
ACPI for ARM?
LWN.net Weekly Edition for November 21, 2013
I'm pretty sure iptables-restore does atomic updates of an entire table. It doesn't let you synchronize across multiple tables (nat, filter, mangle), but I'd hardly call it "leaving things open".
LCE: Challenges for Linux networking
Posted Nov 8, 2012 9:18 UTC (Thu) by rusty (✭ supporter ✭, #26)
That doesn't mean that applications use the kernel API appropriately; for a long time libiptc didn't give you a great way to do atomic updates of more than one rule at a time.
Changing NAT rules is a weird one, because for radical changes you really want to kill all old connections. Figuring out which existing connections would be NATed differently and resetting them might be a nice twist if people were seeing problems here.
Posted Nov 8, 2012 12:48 UTC (Thu) by jengelh (subscriber, #33263)
I do not think you can actually solve this "twist". The fact that NFCT mappings - and thus TCP tuples - do not change when the nat table is changed could be considered a feature in itself. Sort of like an RCU for tuples.
Copyright © 2013, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds