iptables, modules and hotplugging

[sjod]

Hi,

I have a whole stack of routing related modules, ip_conntrack*, ip_nat* and was wondering what the effect of not loading these into the gateway would be.

Is there a way to get hotplugging to load these modules on demand, or am I going to have to load all these on startup (in which case I might as well build them directly into the kernel)?

[SoTired]

The modules all have specific purposes, so it's hard to say what not loading all of them would do.

If you don't load conntrack connections wont be tracked anymore, so rules that use the state of the connection (new, related, established, and what have you) wont work anymore.

NAT provides network address translation, removing that will probably break all of your NAT rules, though I'm not positive about that.

The modules would probably be needed when iptables first loads, hence any dynamic loading of them would be rather pointless.

Compiling into the kernel has advantages and disadvanges - none of the modules are going to increase the size much, and they wont slow anything (well, maybe iptables a bit) down, however so there's no real drawbacks to compiling them in (unless kernel size must be kept down.) On the other hand, loading them as modules will work fine too.

[splooge]

iptables will automagically load the modules it needs if they exist. It knows which module to load from the commands you pass to it.

whether you make modules or compile it into the kernel is personal preference (do you have a need to unload them once loaded?) and won't affect the speed of the system.
_________________
http://get.a.clue.de