Long iptables rules efficiency & performance

When building a long iptables rules, which one is more efficient, to use one long script per line or to use the tables? What about the performance, does it have effect to packets loss and untracked packets?

Example:

1. one script per line

   iptables -A INPUT -i wlan0 -p tcp --sport 80 -j ACCEPT

2. using the tables

   iptables -N table1
   iptables -A INPUT -i wlan0 -j tbl1
   iptables -A table1 -p tcp --sport 80 -j ACCEPT

1 Answer

In your second example, you define a new chain called table1, and route incoming packets to the new chain in order to perform matching on the chain.

This can be a good strategy if, for example, the processing you do on that chain is somewhat heavy and you don't want to subject all incoming packets to it.

But in your example,

• ALL incoming traffic on the wlan0 interface is sent to the new chain (this even includes packets that are part of established connections!)
• The processing on that chain is trivial - just matching by source and destination port.

So in this simple example the extra complexity of defining a new chain and routing everything to it is unnecessary and redundant, and were you able to measure a performance difference, would probably result in the lower performance.

Performance really won't affect you unless you have a lot more rules or much heavier processing.