Can any one can say definitively that using the --multiport extension with iptables rules:

  1. Is faster than creating a rule per port?

  2. Is slower than creating a rule per port?

  3. Makes no difference?

If I had to guess, I would think #1 is most likely, but recognize there must be a chance of #2 or #3 as well. The www.iptables.info description of multiport matching doesn't say anything one way or the other.

The only thing I could find searching the web is this, which implies #2 but is anecdotal, and -- to be prejudicial -- it's easy to be suspicious of gamers and gentoo users ;)


The answer is definitely 1.

Let's say you have some rules like this :

iptables -A INPUT -i eth0 -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --dport 8080 -j ACCEPT

Three times in a row, you will check if the input interface is eth0, and if the L4 protocol is TCP.

With multiport, you check it only once.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.