Difuse/packages
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

BCP38: don't slow down established connections (#2838)

Browse source 
Enabling BCP38 causes an iptables rule to be inserted before this rule:
ACCEPT     all  --  anywhere             anywhere             ID:66773300 ctstate RELATED,ESTABLISHED

This makes all forwarded packets go through the BCP38 ipset match, which slows
down download speed from 440 Mbit/s to 340 Mbit/s.

Only apply BCP38 match rules if state is NEW.

Bump package version.

Signed-off-by: Török Edwin <edwin@skylable.com>
This commit is contained in:
Török Edwin 2016-06-12 16:09:05 +03:00 committed by Toke Høiland-Jørgensen
parent 9093379603
commit 0b2b462ae0
2 changed files with 7 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
net/bcp38/Makefile
View file

@ -6,7 +6,7 @@
include $(TOPDIR)/rules.mk
PKG_NAME:=bcp38
PKG_VERSION:=4
PKG_VERSION:=5
PKG_RELEASE:=1
PKG_LICENCE:=GPL-3.0+

12
net/bcp38/files/run.sh
View file

@ -72,9 +72,9 @@ setup_iptables()
iptables -N "$IPTABLES_CHAIN" 2>/dev/null
iptables -F "$IPTABLES_CHAIN" 2>/dev/null
iptables -I output_rule -j "$IPTABLES_CHAIN"
iptables -I input_rule -j "$IPTABLES_CHAIN"
iptables -I forwarding_rule -j "$IPTABLES_CHAIN"
iptables -I output_rule -m state --state NEW -j "$IPTABLES_CHAIN"
iptables -I input_rule -m state --state NEW -j "$IPTABLES_CHAIN"
iptables -I forwarding_rule -m state --state NEW -j "$IPTABLES_CHAIN"
# always accept DHCP traffic
iptables -A "$IPTABLES_CHAIN" -p udp --dport 67:68 --sport 67:68 -j RETURN
@ -90,9 +90,9 @@ destroy_ipset()
destroy_iptables()
{
iptables -D output_rule -j "$IPTABLES_CHAIN" 2>/dev/null
iptables -D input_rule -j "$IPTABLES_CHAIN" 2>/dev/null
iptables -D forwarding_rule -j "$IPTABLES_CHAIN" 2>/dev/null
iptables -D output_rule -m state --state NEW -j "$IPTABLES_CHAIN" 2>/dev/null
iptables -D input_rule -m state --state NEW -j "$IPTABLES_CHAIN" 2>/dev/null
iptables -D forwarding_rule -m state --state NEW -j "$IPTABLES_CHAIN" 2>/dev/null
iptables -F "$IPTABLES_CHAIN" 2>/dev/null
iptables -X "$IPTABLES_CHAIN" 2>/dev/null
}