Re:Re: [PATCH] ipvs: add a sysctl switch to control ipvs to bypass OUTPUT chain or not

[Julian Anastasov <ja@xxxxxx>]

        Hello,

On Thu, 25 Aug 2022, longguang.yue wrote:

> I see. 
> I hope we could find a maintainable and decoupled way to keep ipvs high 
> performance.
> especially for kubernetes environment, there are from dozens up to one 
> hundred rules in OUTPUT chain.

        May be some rules can help the bunch of rules to
be applied only for first packet, not for every packet in
connection, such as:

iptables -t filter -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -t filter -A OUTPUT -m ipvs --ipvs -j ACCEPT

Regards

--
Julian Anastasov <ja@xxxxxx>