Re: High throughput bgp links using gentoo + stipped kernel

[Ben <ben () meh net nz>]

On Sun, May 19, 2013 at 11:48:17AM -0400, Nick Khamis wrote:
> We do use a statefull iptables on our router, some forward rules...
> This is known to be on of our issues, not sure if having a separate
> iptables box would be the best and only solution for this?
 
Do you actually need stateful filtering?  A lot of people seem to think
that it's important, when really they're accomplishing little from it,
you can block ports etc without it.  And the idea of protecting hosts
from strange traffic is only really significant if the hosts have very
outdated TCP/IP stacks etc.  And it breaks things like having multiple
routers.

There's an obscure NOTRACK rule you can use to cut down the number of
state entries, or remote state tracking for hosts that don't need it.

http://serverfault.com/questions/234560/how-to-turn-iptables-stateless

although googling for NOTRACK should find other things too.

Ben.