From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B3A56C28D13 for ; Thu, 25 Aug 2022 05:33:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232632AbiHYFdF (ORCPT ); Thu, 25 Aug 2022 01:33:05 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53048 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230104AbiHYFdD (ORCPT ); Thu, 25 Aug 2022 01:33:03 -0400 Received: from mg.ssi.bg (mg.ssi.bg [193.238.174.37]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id BCF4C7822B; Wed, 24 Aug 2022 22:33:02 -0700 (PDT) Received: from mg.ssi.bg (localhost [127.0.0.1]) by mg.ssi.bg (Proxmox) with ESMTP id 7320528778; Thu, 25 Aug 2022 08:33:00 +0300 (EEST) Received: from ink.ssi.bg (unknown [193.238.174.40]) by mg.ssi.bg (Proxmox) with ESMTP id 525492888D; Thu, 25 Aug 2022 08:32:59 +0300 (EEST) Received: from ja.ssi.bg (unknown [178.16.129.10]) by ink.ssi.bg (Postfix) with ESMTPS id EBB493C07D1; Thu, 25 Aug 2022 08:32:52 +0300 (EEST) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by ja.ssi.bg (8.17.1/8.16.1) with ESMTP id 27P5WpCj010719; Thu, 25 Aug 2022 08:32:52 +0300 Date: Thu, 25 Aug 2022 08:32:51 +0300 (EEST) From: Julian Anastasov To: "longguang.yue" cc: horms@verge.net.au, kadlec@netfilter.org, fw@strlen.de, pablo@netfilter.org, lvs-devel@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re:Re: [PATCH] ipvs: add a sysctl switch to control ipvs to bypass OUTPUT chain or not In-Reply-To: <31196e83.2cbe.182d3693f03.Coremail.bigclouds@163.com> Message-ID: References: <20220819100702.14889-1-bigclouds@163.com> <495ceee5-f8dc-06e-d1ef-258d1889c7b8@ssi.bg> <31196e83.2cbe.182d3693f03.Coremail.bigclouds@163.com> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="-1463811672-110765213-1661405572=:5176" Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org This message is in MIME format. The first part should be readable text, while the remaining parts are likely unreadable without MIME-aware tools. ---1463811672-110765213-1661405572=:5176 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8BIT Hello, On Thu, 25 Aug 2022, longguang.yue wrote: > I see.  > I hope we could find a maintainable and decoupled way to keep ipvs high performance. > especially for kubernetes environment, there are from dozens up to one hundred rules in OUTPUT chain. May be some rules can help the bunch of rules to be applied only for first packet, not for every packet in connection, such as: iptables -t filter -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -t filter -A OUTPUT -m ipvs --ipvs -j ACCEPT Regards -- Julian Anastasov ---1463811672-110765213-1661405572=:5176--