Is the produced iptables firewall optimized?
You have to understand that FireHOL is a generic tool. As such, you gain something and you loose something. Except the fact that all FireHOL configuration rules take one iptables chain (that is one “jump”) the produced rules are fully optimized. In many cases, this “jump” optimizes the firewall even further (for example in interface and router statements), while in other cases the “jumps” could be moved to a place where they are really necessary (it is not possible to avoid them). The good thing is that these “jumps” are not so expensive. So, although there is some room for improvement, I have reports from users saying that a huge FireHOL firewall did not introduced a noticable increase in CPU utilization compared to a hand made firewall, for the same traffic. For the moment, I prefer to keep all the “jumps” there, since it makes the iptables rules a lot more clear and easy to understand. If you believe that I should work on this and you can prove that the “jumps” that could be moved d
