Zakk 8b818ffc41 fix(iptables): match the transparent-proxy whitelist with ipset ...

The iptables path wrote each whitelisted CIDR with its own iptables
process. With the mainland China group (about 15,000 CIDRs) a core start
spent minutes on this, and every packet of a direct connection walked
the list linearly.

Load each family into one hash:net set with a single `ipset restore` and
match it with one rule at the old position. Without ipset, write the
rules with one `iptables-restore --noflush` per family; without that,
keep the per-rule commands. Cleanup destroys the sets.

2026-09-24 01:23:08 +10:00

..

command_test.go

fix(iptables): match the transparent-proxy whitelist with ipset

2026-09-24 01:23:08 +10:00

command.go

fix(iptables): match the transparent-proxy whitelist with ipset

2026-09-24 01:23:08 +10:00