2

So I implemented some a different set of iptables rules and now if i enable them, then lighttpd simply takes forever to load php enabled pages(like wp). There is no load on the server, processor usage stays low.

Here is my config, what could be the cause of this ?

*filter

:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:fail2ban-ssh - [0:0]
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 2012 -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 1194 -j ACCEPT 
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT 
-A INPUT -i lo -j ACCEPT 


-A OUTPUT -j ACCEPT 

-A INPUT -j DROP 
COMMIT

4 Answers 4

10

You're missing a rule to accept traffic based on existing traffic (the rule that makes iptables stateful). This should be your very first rule:

-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
2
  • 4
    Note that this can be further adapted to -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT. I've discovered that conntrack is more preferred in recent kernels, with state being a fallback. Nov 30, 2015 at 0:11
  • Can you comment on what this does? Say there is already a connection established on port 50 and I apply this, would it let it continue to connect if I add a rule drop all on port 50?
    – Lazik
    Apr 13, 2022 at 4:02
8

You're blocking incoming DNS responses, and apparently lighttpd (or wp) is configured to resolve IP addresses to hostnames.

You should be able to fix this with something like

-A INPUT -p udp -m udp --sport 53 -j ACCEPT

since the UDP packets for DNS responses originate from port 53.

2
  • You gave him the fish, now he won't learn to solve it right but just copy/paste. You're disallowing him from hacking to hell, this was not a humbling experience to me... Aug 11, 2012 at 13:55
  • @TomWijsman eh, it's just the most glaring mistake, it's probably not even the only one.
    – DerfK
    Aug 11, 2012 at 15:44
2

As the details about the complete setup are not known, then i can suggest you to to following. Just before the Drop rule, add a rule to LOG all traffic. Then check your syslog logs for those packets which are being dropped. You will know that what type of packets are being dropped or denied, then you can create a rule based on those types of packets to be allowed.

0

The cause is missing comments and logging:

  • Can you tell what each line does in about a month of now?

  • Did you compare the log of your iptables firewall before and after you put this into effect?

Those two questions should help you find the issue, you're blocking something too much...

3
  • 1
    iptables is a user space application program that allows a system administrator to configure the tables provided by the Linux kernel firewall, your turn again? Aug 11, 2012 at 13:54
  • It's a program to configure the firewall so its not a firewall ;p
    – HackToHell
    Aug 11, 2012 at 15:02
  • @HackToHell: I never said it was, you're using a firewall that is using iptables... ;) Aug 11, 2012 at 15:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .