[SOLVED] iptables slow [slackware 10.1]

Wim Sturkenboom · 06-07-2006, 10:54 AM

Not sure if it belongs here or in general (or maybe even in security). I'm using sshd for connectivity to my server (172.31.212.37). It's set up for key authentication.

Before running my iptables script (see below):
When I connect from one of the trusted machines (see below) and I enter my username, I'm immediately prompted for my passphrase.

After running the script, this passphrase prompt takes between 15 and 20 seconds to appear.

IPTABLES script

Code:

#!/bin/sh
# initial block
iptables -P INPUT DROP
iptables -P FORWARD DROP

# accept anything on localhost
iptables -A INPUT -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT

# allow HTTPS from any machine on 172.*.*.*
iptables -A INPUT -s 172.0.0.0/8 -p tcp --dport 443 -j ACCEPT

# allow SSH from trusted machines
iptables -A INPUT -s 172.31.212.19 -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -s 172.31.212.53 -p tcp --dport 22 -j ACCEPT

Any explanation?

FYI

Code:

root@btd-techweb01:/# iptables -nvL
Chain INPUT (policy DROP 335 packets, 68806 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  *      *       127.0.0.1            127.0.0.1
    0     0 ACCEPT     tcp  --  *      *       172.0.0.0/8          0.0.0.0/0           tcp dpt:443
20353 1603K ACCEPT     tcp  --  *      *       172.31.212.19        0.0.0.0/0           tcp dpt:22
    0     0 ACCEPT     tcp  --  *      *       172.31.212.53        0.0.0.0/0           tcp dpt:22

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 16681 packets, 4901K bytes)
 pkts bytes target     prot opt in     out     source               destination

PS I'm completely new to iptables

osor · 06-07-2006, 12:26 PM

Try looking at the ssh logs. If you don't see anything, try using DEBUG logging level or `ssh -vvv' or similar.

Wim Sturkenboom · 06-08-2006, 03:28 AM

Debug level 3; found this

Code:

Jun  8 09:01:41 btd-techweb01 sshd[3969]: debug3: account expiration disabled
Jun  8 09:01:41 btd-techweb01 sshd[3969]: debug3: Trying to reverse map address 172.31.212.19.
Jun  8 09:02:01 btd-techweb01 sshd[3969]: debug3: mm_answer_pwnamallow: sending MONITOR_ANS_PWNAM: 1

The connection started at 09:01:38. The highlighted line takes 20 seconds.

Thank you very much, added the client machine to /etc/hosts and it works as before.