# iptables-restore takes a long time.

## josh

I have a huge iptables ruleset. I have a vonnage phone adapter behind my router. (I know that the phone adapter can be used as a router but its not very configurable for my purposes). And amongst the ports it has open are 10000 thru 20000. It took long enough to load them the first time (with a perl script that  ran a loop.) But iptables restore takes about 5 minutes to bring it back up. Is there a faster way? I'm sure that the adapter doesn't need this many ports. But there's no reason that linux can't open that many ports faster. So I know I'm doing something wrong. Is there a special way to specify a portrange? Because I can't find how to do it.

----------

## moocha

To select a portrange, all you need to do is provide both limits to --dport, separated by a colon. In your case it'd be something like

```
iptables -A INPUT -p tcp --dport 10000:20000 -j ACCEPT
```

That will select the portrange 10,000 to 20,000, inclusive. This will also increase performance dramatically, since every rule takes up memory and needs to be checked for every packet that travels through that interface - 10,000 rules eat a lot.

----------

## josh

Thanks man. Yeah, I did indeed notice a decrease in performance. This is much better. Another quick question; I've been forwarding to an internal IP like this: "--to 192.168.0.10:80", for example. So for this I couldn't see a good way to do it. I just left off the port and now my line looks like so:

```
${IPTABLES} -t nat -A PREROUTING ! -i ${PHONEIF} -p udp --dport 10000:20000 -j DNAT --to ${PHONEIP}
```

It does work. But is this the correct way to do it? It makes more sense then the way I was doing it.

----------

## moocha

Should work fine.

----------

