Реклама: |
If you have experience with other packet filters, you may find this layout to be
confusing, and you may be speculating that there are problems with portability with other
filters and speed of rule matching. Imagine if you had 100 rules and most of the
applicable ones were the first 10. There would be a terrible overhead for every packet
coming in to go through 100 rules every time. Fortunately, there is a simple keyword you
can add to any rule that makes it take action at that match. That keyword is quick.
Here's a modified copy of the original ruleset using the quick keyword:
block in quick all
pass in all
In this case, IPF looks at the first rule:
block in quick all
The packet matches and the search is over. The packet is expunged without a peep.
There are no notices, no logs, no memorial service. Cake will not be served. So what about
the next rule?
pass in all
This rule is never encountered. It could just as easily not be in the config file
at all. The sweeping match of all and the terminal keyword quick from
the previous rule make certain that no rules are followed afterward.
Having half a config file laid to waste is rarely a desirable state. On the other hand,
IPF is here to block packets and as configured, it's doing a very good job. Nonetheless,
IPF is also here to let some packets through, so a change to the ruleset to make this
possible is called for.