LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 02-08-2017, 05:18 AM   #1
luofeiyu
Member
 
Registered: Aug 2015
Posts: 237

Rep: Reputation: Disabled
Why the iptables rules slow down net transposrt speed?


I want to block all http website except www.sina.com.cn.

Code:
dig www.sina.com.cn
www.sina.com.cn.	3416	IN	CNAME	jupiter.sina.com.cn.
jupiter.sina.com.cn.	30	IN	A	183.232.24.117
jupiter.sina.com.cn.	30	IN	A	183.232.24.115
jupiter.sina.com.cn.	30	IN	A	183.232.24.116
jupiter.sina.com.cn.	30	IN	A	183.232.24.112
jupiter.sina.com.cn.	30	IN	A	183.232.24.114
jupiter.sina.com.cn.	30	IN	A	183.232.24.113
jupiter.sina.com.cn.	30	IN	A	183.232.24.111
Here is my iptables rules configuration to block all other website except www.sina.com.cn

Code:
iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     tcp  --  183.232.24.117       anywhere             tcp spt:http
ACCEPT     tcp  --  183.232.24.116       anywhere             tcp spt:http
ACCEPT     tcp  --  183.232.24.115       anywhere             tcp spt:http
ACCEPT     tcp  --  183.232.24.114       anywhere             tcp spt:http
ACCEPT     tcp  --  183.232.24.113       anywhere             tcp spt:http
ACCEPT     tcp  --  183.232.24.112       anywhere             tcp spt:http
ACCEPT     tcp  --  183.232.24.111       anywhere             tcp spt:http
DROP       tcp  --  anywhere             anywhere             tcp spt:http

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             183.232.24.117       tcp dpt:http
ACCEPT     tcp  --  anywhere             183.232.24.116       tcp dpt:http
ACCEPT     tcp  --  anywhere             183.232.24.115       tcp dpt:http
ACCEPT     tcp  --  anywhere             183.232.24.114       tcp dpt:http
ACCEPT     tcp  --  anywhere             183.232.24.113       tcp dpt:http
ACCEPT     tcp  --  anywhere             183.232.24.112       tcp dpt:http
ACCEPT     tcp  --  anywhere             183.232.24.111       tcp dpt:http
DROP       tcp  --  anywhere             anywhere             tcp dpt:http
Code:
iptables-save > /etc/iptables/rules.v4
Now to test it to input www.sina.com.cn in firefox.

I found that speed to open the website www.sina.com.cn slow down ,very very slow.
Usually it cost 1 second to open the website www.sina.com.cn,it cost almost 1 minutes to open ,why and how to fix it?
 
Old 02-09-2017, 12:49 PM   #2
pingu_penguin
Member
 
Registered: Aug 2004
Location: pune
Distribution: Slackware
Posts: 349

Rep: Reputation: 60
If you think its an iptables issue, you can try setting the default iptables policy of OUTPUT chain to DROP , if it is not.

#/sbin/iptables -P INPUT ACCEPT
#/sbin/iptables -P FORWARD DROP
#/sbin/iptables -P OUTPUT DROP

#iptables -A OUTPUT -p tcp --dport 80 -d sina.com.cn -j ACCEPT

you can modify INPUT and FORWARD policy as per requirements obviously. Hope you get my idea.

Otherwise you may need to evaluate the bandwidth for your network, like check for packet loss, routing misconfigurations etc.
 
Old 02-10-2017, 05:09 AM   #3
r3sistance
Senior Member
 
Registered: Mar 2004
Location: UK
Distribution: CentOS 6/7
Posts: 1,375

Rep: Reputation: 217Reputation: 217Reputation: 217
Did you at any point think that www.sina.com.cn maybe using assets from other places?

for example I can see a javascript file from d1.sina.com.cn on a curl.

# dig d1.sina.com.cn +short
ad4.sina.com.cn.
i3.sina.com.cn.
http.sina.com.cn.edgesuite.net.
a1957.g1.akamai.net.
23.212.108.209
23.212.108.182

I don't know what you are trying to achieve but I do not think iptables is necessarily the right tool here. More so you are dropping the outbound traffic instead of rejecting (output should never need to be dropped IMO), so the browser is just waiting for those assets to timeout.

Last edited by r3sistance; 02-10-2017 at 05:11 AM.
 
Old 02-23-2017, 02:13 AM   #4
ushan
LQ Newbie
 
Registered: Feb 2017
Posts: 1

Rep: Reputation: Disabled
how to convert in disk in LVM partition
 
Old 02-23-2017, 02:51 AM   #5
r3sistance
Senior Member
 
Registered: Mar 2004
Location: UK
Distribution: CentOS 6/7
Posts: 1,375

Rep: Reputation: 217Reputation: 217Reputation: 217
Ushan, please do not try to hijack threads for completely unrelated matters. If you have an issue then please create a new thread in the relevant forum (LVM has nothing to do with networking).

I'd suggest going to the newbie forum, which you should read the following thread from: http://www.linuxquestions.org/questi...osting-356388/
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] /etc/udev/rules.d/70-persistent-net.rules and 'ip link' rename rakeafake Linux - Networking 4 02-01-2016 08:34 PM
IPTABLES is slow after adding some rules secrets88 Linux - Security 2 06-10-2015 10:28 AM
[SOLVED] Missing /etc/udev/rules.d/70-persistent-net.rules - Chapter 7.2.1. Mordillo98 Linux From Scratch 5 06-11-2012 08:37 PM
Slack 13.1 : /etc/udev/rules.d70-persistent-net.rules Ramurd Slackware 10 02-18-2011 09:56 AM
cat: /etc/udev/rules.d/70-persistent-net.rules: No such file or directory rcg1984 Linux From Scratch 2 09-17-2008 07:02 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 06:16 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration