The iptables rules and Internet speed

Jason.nix · 04-24-2023, 05:54 AM

Hello,
I use the following iptables rules and I want to know can it reduce my Internet speed:

Code:

iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -N SYN_FLOOD
iptables -A INPUT -p tcp --syn -j SYN_FLOOD
iptables -A SYN_FLOOD -m limit --limit 5/s --limit-burst 10 -j RETURN
iptables -A SYN_FLOOD -j DROP

Any idea?

Thank you so much.

Jason.nix · 04-29-2023, 07:54 AM

Hello,
No idea?

Jan K. · 04-29-2023, 12:05 PM

From someone who's brain melted trying to understand anything iptables...

How about disabling it, test speed, enable, test speed?

https://kerneltalks.com/howto/how-to...l-temporarily/

astrogeek · 04-29-2023, 12:26 PM

Quote:

Originally Posted by Jason.nix

Hello,
I use the following iptables rules and I want to know can it reduce my Internet speed:

Code:

iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -N SYN_FLOOD
iptables -A INPUT -p tcp --syn -j SYN_FLOOD
iptables -A SYN_FLOOD -m limit --limit 5/s --limit-burst 10 -j RETURN
iptables -A SYN_FLOOD -j DROP

You need to define your use case and what your objective is much more clearly.

Your rules limit the number of new TCP requests which get through, but that is not equivalent to limiting "internet speed", not even close.

As your rules are applied to incoming requests I would conclude that this is for an internet exposed server of some sort, not a desktop machine. If so, these rules are inadequate for any real world purpose.

In general iptables rules cannot limit speed, that requires another tool named tc (for traffic control). See man tc for an introduction.

jefro · 04-29-2023, 03:16 PM

Kind of two things going on. One is software based filtering. Two is the amount of processing power that might be needed to enforce the rules. I can't guess that so I agree with need for testing on your use.

Generally the sales pitch for hardware based devices is that they are designed to operate closer to wire speeds.

Jason.nix · 05-01-2023, 04:22 AM

Quote:

Originally Posted by astrogeek

You need to define your use case and what your objective is much more clearly.

Your rules limit the number of new TCP requests which get through, but that is not equivalent to limiting "internet speed", not even close.

As your rules are applied to incoming requests I would conclude that this is for an internet exposed server of some sort, not a desktop machine. If so, these rules are inadequate for any real world purpose.

In general iptables rules cannot limit speed, that requires another tool named tc (for traffic control). See man tc for an introduction.

Hello,
Thank you so much for your reply.
I mean downloading through the Internet.
What do you mean?

Quote:

If so, these rules are inadequate for any real world purpose.

Turbocapitalist · 05-01-2023, 07:29 AM

Quote:

Originally Posted by Jason.nix

I mean downloading through the Internet.
What do you mean?

Read the iptables ruleset that you posted, it won't affect a desktop system in any meaningful way. As mentioned tc is used for traffic shaping, in conjunction with either iptables or nftables. The latter is preferable, so if you are starting out, ignore iptables and focus on nftables instead.

One thing about traffic shaping rules is that they can only really affect outgoing bandwidth. Random Early Detection might be an option for influencing incoming connections but by and large traffic shaping only affects outgoing data.

astrogeek · 05-01-2023, 10:45 AM

Quote:

Originally Posted by Jason.nix

Hello,
Thank you so much for your reply.
I mean downloading through the Internet.
What do you mean?

What I meant about the rules being inadequate was that if this were for a server (which apparently it is not) then those rules would not provide any useful level of function. For an internet facing server you would want to manage connections by protocol, port and probably other parameters.

If this is for a desktop computer, presumably behind a router, you should probably not see any NEW or SYN packets from the outside world unless you have enabled selected pass through in the router. So limiting the number of SYN packets will not really affect anything and those rules serve no useful purpose here either.

As mentioned, you can only control the speed (actually bandwidth) of outgoing traffic because the sender determines how fast incoming traffic arrives. Typically, to limit download speed from the internet you want to delay outgoing ACK packets as a function of the total number of bytes received per second. You can do this with iptables/tc, but if you simply want to limit the bandwidth of specific large downloads so as to allow other uses like web browsing to continue at the same time, perhaps using a utility which allows you to throttle bandwidth like wget would provide a simpler solution.

So the real qusetion is, what problem are you actually trying to solve?