GitHub user remibergsma opened a pull request:
https://github.com/apache/cloudstack/pull/1482
Restore iptables at once using iptables-restore instead of calling iptables
numerous times
This makes handling the firewall rules about 50-60 times faster because it
is generated in memory and then loaded once. It's work by @borisroman see PR
#1400. Reopened it here because I think this is a great improvement.
You can merge this pull request into a Git repository by running:
$ git pull https://github.com/remibergsma/cloudstack iptables-fix
Alternatively you can review and apply these changes as the patch at:
https://github.com/apache/cloudstack/pull/1482.patch
To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:
This closes #1482
----
commit 0f75042566b7cc72666708485bdaa9337721e9fe
Author: Boris Schrijver <bschrij...@schubergphilis.com>
Date: 2016-02-01T14:57:26Z
Add iptables copnversion script.
Source:
https://raw.githubusercontent.com/sl0/conv/master/iptables_converter.py
commit b857f79fcb14b9594840e483cfcf0e4c0fac2f6b
Author: Boris Schrijver <bschrij...@schubergphilis.com>
Date: 2016-02-01T14:58:27Z
Restore iptables at once using iptables-restore instead of calling iptables
numerous times
commit 69e9348900e6337a16788a54283d5c9ee3b7a221
Author: Boris Schrijver <bschrij...@schubergphilis.com>
Date: 2016-02-03T14:30:19Z
Remove duplicate spaces, and thus duplicate rules.
commit eb9706b6558d5113000a6c10d861308fbc8cd692
Author: Boris Schrijver <bschrij...@schubergphilis.com>
Date: 2016-02-03T15:15:28Z
Wait for dnsmasq to finish restart
commit 18d5cd285536954403cf5eec64024e5909e55d41
Author: Boris Schrijver <bschrij...@schubergphilis.com>
Date: 2016-02-05T20:04:06Z
Do not load previous firewall rules as we replace everyhing anyway
commit 709be45cf0f32bacc54ec2384be9e54bd62a5acf
Author: Boris Schrijver <bschrij...@schubergphilis.com>
Date: 2016-02-05T20:06:53Z
Check the existence of 'forceencap' parameter before use
commit 30741a3309da346f324a8f365cb6ef8e1aab39d8
Author: Boris Schrijver <bschrij...@schubergphilis.com>
Date: 2016-02-05T20:11:59Z
Split the cidr lists so we won't hit the iptables-resture limits
----
---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastruct...@apache.org or file a JIRA ticket
with INFRA.
---
