Optimizing Kernel for huge iptables ruleset

Aloh=E1!

The situation:

AMD 1600 XP w/ 640 MB RAM @ 100MHZ FSB, one 3COM 905B eth1 connected to=20
LAN, one 3COM 905C connected to ADSL Modem (1024/128 line).

Two iptables rulesets:
The first 'normal' ruleset is pretty restrictive against connetions from=20
the outside, more or less open towards connections opened from the LAN.
The second ruleset inserted after the first is a huge IP blacklist=20
(1.4MB iptables script!) that takes nearly half an hour to be inserted=20
into the running ruleset.

Adamantix Kernel 2.4.26 w/ PaX, stack & adress space randomization and=20
all the other goodies except for RSBAC has about every networking=20
functionality compiled in that has to do with traffic shaping/routing=20
(need to shape the LAN for the small upstream bandwidth)

The problem:

When transferring data, output on the NICs (well, I tested it with netio=20
on eth1) is reduced to a crawling 400KB/s, top shows the system CPU load=20
going up to around 94-97% while the netio process (or samba, doesn't=20
matter) tries to get another 50%+ CPU time.

With just the first ruleset everything is fine (although the process=20
transferring still wants quite a lot of CPU for my taste).

The question: Is my Kernel to bloated? Is there a way to further=20
optimize for networking? Can I provide more specific information (Didn't=20
want to paste /usr/src/linux/.config or the like just yet ;-)?

I have another firewall elsewhere that is running IPCop on a P200 Pro w/=20
64MB RAM and that one is taking the same blocklist without any problems,=20
so I am a bit surprised to see this machine suffer. Then again that one=20
is only firewalling/routing between two 100MBit Subnets and doesn't have=20
to deal with pppoe or the like. IIRC IPCop still uses a 2.2 Kernel?=20
Could it really be all the shaping functionality slowing things down so=20
much?

best regards - at a loss

Martin


--=20
To UNSUBSCRIBE, email to [email protected]
with a subject of "unsubscribe". Trouble? Contact [email protected]=
.org