Does performance get affected by use of iptables for LXC containers? If yes, whats alternative

1

I am using iptables to listen internal IP : Port on external IP : Port by using this syntax -

sudo -E bash -c ‘iptables -t nat -I PREROUTING -i eth0 -p TCP -d $PUBLIC_IP --dport $PORT -j DNAT --to-destination $CONTAINER_IP:$PORT -m comment --comment “forward to the Nginx container”’

I am not getting any exact answer about affect on CPU utilization by Iptables for LXCs.
If CPU utilization of a process increases when iptables are enabled on the system then what is alternative method to listen internal IP : Port on external IP : Port

2

Hi!

iptables rules exist in kernel space while a LXD proxy device is a user-space process.
There should be some speed benefits in iptables but with LXD proxy devices you get ease of use, added functionality (in-built PROXY protocol), and rules are associated with the correct container.

The big question is how massive should the network load be, so that differences in response time would become noticeable.
I do not have an answer to that and I would be interested to see someone produce a comparison.

1 Like