LinuxQuestions.org
Latest LQ Deal: Complete CCNA, CCNP & Red Hat Certification Training Bundle
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 11-27-2007, 09:59 AM   #1
treebug
LQ Newbie
 
Registered: Mar 2005
Posts: 29

Rep: Reputation: 15
iptables slowing things down


When I try to ssh into my machine running iptables, I get the login prompt and type in the username. It takes about 17 seconds for the password prompt to come up when I have iptables on.

Also, if I do an iptables -L it takes about 30 seconds to display the list.
Do I have something misconfigured?

/sbin/iptables -F
/sbin/iptables -A INPUT -p tcp -m state --state ESTABLISHED -j ACCEPT
/sbin/iptables -A INPUT -s x.x.x.3 -p udp -j ACCEPT
/sbin/iptables -A INPUT -s x.x.x.4 -p udp -j ACCEPT
/sbin/iptables -A INPUT -s x.x.x.1 -p udp --dport 123 -j ACCEPT
/sbin/iptables -A INPUT -s x.x.x.0/24 -p tcp -m tcp --dport 22 -j ACCEPT
/sbin/iptables -A INPUT -j DROP

Thanks.
 
Old 11-27-2007, 11:50 AM   #2
win32sux
LQ Guru
 
Registered: Jul 2003
Location: Los Angeles
Distribution: Ubuntu
Posts: 9,870

Rep: Reputation: 377Reputation: 377Reputation: 377Reputation: 377
Does the SSH work fine if you set policies to ACCEPT and flush?

BTW, sticking a LOG rule above that DROP should give you the necessary insight.
 
Old 11-27-2007, 03:03 PM   #3
treebug
LQ Newbie
 
Registered: Mar 2005
Posts: 29

Original Poster
Rep: Reputation: 15
It logs in fine when I flush the rules. I also moved the ssh rule to the top. This didn't change anything. I set the last rule as -j ACCEPT instead of DROP and it gives me the password prompt right away.

Last edited by treebug; 11-27-2007 at 03:05 PM.
 
Old 11-27-2007, 04:33 PM   #4
win32sux
LQ Guru
 
Registered: Jul 2003
Location: Los Angeles
Distribution: Ubuntu
Posts: 9,870

Rep: Reputation: 377Reputation: 377Reputation: 377Reputation: 377
Quote:
Originally Posted by treebug View Post
I set the last rule as -j ACCEPT instead of DROP and it gives me the password prompt right away.
That's great, because it means for sure its the firewall rules.

Maybe post what you get in the log file when you try to connect?
Code:
/sbin/iptables -F
/sbin/iptables -A INPUT -p tcp -m state --state ESTABLISHED -j ACCEPT
/sbin/iptables -A INPUT -s x.x.x.3 -p udp -j ACCEPT
/sbin/iptables -A INPUT -s x.x.x.4 -p udp -j ACCEPT
/sbin/iptables -A INPUT -s x.x.x.1 -p udp --dport 123 -j ACCEPT
/sbin/iptables -A INPUT -s x.x.x.0/24 -p tcp -m tcp --dport 22 -j ACCEPT
/sbin/iptables -A INPUT -j LOG --log-prefix "INPUT DROP: "
/sbin/iptables -A INPUT -j DROP
 
Old 11-28-2007, 02:15 PM   #5
treebug
LQ Newbie
 
Registered: Mar 2005
Posts: 29

Original Poster
Rep: Reputation: 15
I only see a lot of dropped broadcasted traffic.
 
Old 11-28-2007, 02:23 PM   #6
nx5000
Senior Member
 
Registered: Sep 2005
Location: Out
Posts: 3,307

Rep: Reputation: 55
Maybe dns blocked and the server is asking for the name of the client?
Which would also explain why iptables -L is slow.
iptables -nL is also slow?
 
Old 11-29-2007, 02:38 PM   #7
treebug
LQ Newbie
 
Registered: Mar 2005
Posts: 29

Original Poster
Rep: Reputation: 15
THATS IT!
iptables -nL works geat!
 
Old 11-29-2007, 03:13 PM   #8
nx5000
Senior Member
 
Registered: Sep 2005
Location: Out
Posts: 3,307

Rep: Reputation: 55
90% of the time when something takes very long to connect you (ftp, ssh,..) and then finally works, it's a DNS problem.

 
Old 11-30-2007, 07:41 AM   #9
win32sux
LQ Guru
 
Registered: Jul 2003
Location: Los Angeles
Distribution: Ubuntu
Posts: 9,870

Rep: Reputation: 377Reputation: 377Reputation: 377Reputation: 377
Yup. That's true. BTW, I think I might have spotted the problem:
Quote:
/sbin/iptables -A INPUT -p tcp -m state --state ESTABLISHED -j ACCEPT
Notice how it only matches against TCP packets. That would mean the returning UDP packets for the DNS lookups wouldn't get sent to ACCEPT by it. Your box may be doing TCP-fallback after a while when it realizes UDP didn't work, I don't know. You also are missing a rule for the loopback interface, which although likely not related to your current issue is still a pretty standard rule to have. Try this:
Code:
/sbin/iptables -F
/sbin/iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
/sbin/iptables -A INPUT -i lo -j ACCEPT
/sbin/iptables -A INPUT -s x.x.x.3 -p udp -j ACCEPT
/sbin/iptables -A INPUT -s x.x.x.4 -p udp -j ACCEPT
/sbin/iptables -A INPUT -s x.x.x.1 -p udp --dport 123 -j ACCEPT
/sbin/iptables -A INPUT -s x.x.x.0/24 -p tcp -m tcp --dport 22 -j ACCEPT
/sbin/iptables -A INPUT -j DROP

Last edited by win32sux; 11-30-2007 at 07:49 AM.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Suse: confused on many things, why is installing things so hard? blackflare Linux - Newbie 11 10-16-2007 04:35 AM
LXer: Things found on the way to other things. LXer Syndicated Linux News 0 01-06-2007 08:03 PM
Why is my system slowing down? BajaNick Slackware 19 04-15-2004 03:41 AM
iptables & rc.local starting script = applications are slowing down. immer Linux - Networking 3 12-13-2003 09:11 AM
PC slowing down hardigunawan Linux - General 2 06-03-2002 09:56 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 11:39 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration