> -A tap110i0-IN -m conntrack --ctstate INVALID,NEW -j PVEFW-smurfs > -A tap110i0-IN -p udp -m udp --sport 67 --dport 68 -j ACCEPT > -A tap110i0-IN -p tcp -j PVEFW-tcpflags > -A tap110i0-IN -m conntrack --ctstate INVALID -j DROP > -A tap110i0-IN -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT # move > this to chain start?
Would we gain some performance if we move that test to the start of the chain? _______________________________________________ pve-devel mailing list [email protected] http://pve.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
