LinuxQuestions.org - Why the iptables rules slow down net transposrt speed?

- Linux - Networking (https://www.linuxquestions.org/questions/linux-networking-3/)

- - Why the iptables rules slow down net transposrt speed? (https://www.linuxquestions.org/questions/linux-networking-3/why-the-iptables-rules-slow-down-net-transposrt-speed-4175599262/)

Why the iptables rules slow down net transposrt speed?

I want to block all http website except www.sina.com.cn.

Code:

dig www.sina.com.cn

www.sina.com.cn.        3416        IN        CNAME        jupiter.sina.com.cn.

jupiter.sina.com.cn.        30        IN        A        183.232.24.117

jupiter.sina.com.cn.        30        IN        A        183.232.24.115

jupiter.sina.com.cn.        30        IN        A        183.232.24.116

jupiter.sina.com.cn.        30        IN        A        183.232.24.112

jupiter.sina.com.cn.        30        IN        A        183.232.24.114

jupiter.sina.com.cn.        30        IN        A        183.232.24.113

jupiter.sina.com.cn.        30        IN        A        183.232.24.111

Here is my iptables rules configuration to block all other website except www.sina.com.cn

Code:

iptables -L

Chain INPUT (policy ACCEPT)

target    prot opt source              destination        

ACCEPT    tcp  --  183.232.24.117      anywhere            tcp spt:http

ACCEPT    tcp  --  183.232.24.116      anywhere            tcp spt:http

ACCEPT    tcp  --  183.232.24.115      anywhere            tcp spt:http

ACCEPT    tcp  --  183.232.24.114      anywhere            tcp spt:http

ACCEPT    tcp  --  183.232.24.113      anywhere            tcp spt:http

ACCEPT    tcp  --  183.232.24.112      anywhere            tcp spt:http

ACCEPT    tcp  --  183.232.24.111      anywhere            tcp spt:http

DROP      tcp  --  anywhere            anywhere            tcp spt:http



Chain FORWARD (policy ACCEPT)

target    prot opt source              destination        



Chain OUTPUT (policy ACCEPT)

target    prot opt source              destination        

ACCEPT    tcp  --  anywhere            183.232.24.117      tcp dpt:http

ACCEPT    tcp  --  anywhere            183.232.24.116      tcp dpt:http

ACCEPT    tcp  --  anywhere            183.232.24.115      tcp dpt:http

ACCEPT    tcp  --  anywhere            183.232.24.114      tcp dpt:http

ACCEPT    tcp  --  anywhere            183.232.24.113      tcp dpt:http

ACCEPT    tcp  --  anywhere            183.232.24.112      tcp dpt:http

ACCEPT    tcp  --  anywhere            183.232.24.111      tcp dpt:http

DROP      tcp  --  anywhere            anywhere            tcp dpt:http

Code:

iptables-save > /etc/iptables/rules.v4

Now to test it to input www.sina.com.cn in firefox.

I found that speed to open the website www.sina.com.cn slow down ,very very slow.
Usually it cost 1 second to open the website www.sina.com.cn,it cost almost 1 minutes to open ,why and how to fix it?

If you think its an iptables issue, you can try setting the default iptables policy of OUTPUT chain to DROP , if it is not.

#/sbin/iptables -P INPUT ACCEPT
#/sbin/iptables -P FORWARD DROP
#/sbin/iptables -P OUTPUT DROP

#iptables -A OUTPUT -p tcp --dport 80 -d sina.com.cn -j ACCEPT

you can modify INPUT and FORWARD policy as per requirements obviously. Hope you get my idea.

Otherwise you may need to evaluate the bandwidth for your network, like check for packet loss, routing misconfigurations etc.

Did you at any point think that www.sina.com.cn maybe using assets from other places?

for example I can see a javascript file from d1.sina.com.cn on a curl.

# dig d1.sina.com.cn +short
ad4.sina.com.cn.
i3.sina.com.cn.
http.sina.com.cn.edgesuite.net.
a1957.g1.akamai.net.
23.212.108.209
23.212.108.182

I don't know what you are trying to achieve but I do not think iptables is necessarily the right tool here. More so you are dropping the outbound traffic instead of rejecting (output should never need to be dropped IMO), so the browser is just waiting for those assets to timeout.

how to convert in disk in LVM partition

Ushan, please do not try to hijack threads for completely unrelated matters. If you have an issue then please create a new thread in the relevant forum (LVM has nothing to do with networking).

I'd suggest going to the newbie forum, which you should read the following thread from: http://www.linuxquestions.org/questi...osting-356388/