2

Here is the output of an "iptables-save":

# Generated by iptables-save v1.4.4 on Sun Nov 21 11:28:56 2010
*mangle
:PREROUTING ACCEPT [921:116690]
:INPUT ACCEPT [921:116690]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [856:343403]
:POSTROUTING ACCEPT [856:343403]
COMMIT
# Completed on Sun Nov 21 11:28:56 2010
# Generated by iptables-save v1.4.4 on Sun Nov 21 11:28:56 2010
*nat
:PREROUTING ACCEPT [18:1076]
:POSTROUTING ACCEPT [189:12510]
:OUTPUT ACCEPT [189:12510]
COMMIT
# Completed on Sun Nov 21 11:28:56 2010
# Generated by iptables-save v1.4.4 on Sun Nov 21 11:28:56 2010
*filter
:INPUT DROP [188:58400]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [856:343403]
-A INPUT -p icmp -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT 
-A INPUT -p udp -m udp --dport 22 -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT 
-A INPUT -p udp -m udp --dport 80 -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 53 -j ACCEPT 
-A INPUT -p udp -m udp --dport 53 -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT 
-A INPUT -p udp -m udp --dport 443 -j ACCEPT 
COMMIT
# Completed on Sun Nov 21 11:2

The server hosts my bind server which is serving as the authoritative nameserver for the particular domain in question. The server also hosts the site itself. What could cause this slowdown when activating iptables rules with these ports open? Am I missing some ports that should allow dns to work correctly?

2 Answers 2

2

Is your webserver trying to reverse-resolve IP addresses to hostnames? When bind has to either recurse or forward requests, by default (as of bind 8.1) it chooses random ports to make its requests from. Since UDP packets are returned to the port that sent it, they are blocked by this firewall.

You can uncomment

query-source address * port 53;

in the named.conf.options file (on Debian, anyway) to force it to use port 53. Random ports are chosen in order to help prevent cache poisoning attacks (where someone returns a spoofed response packet back to you before the real packet arrives) so it's a good idea to fix the firewall instead of changing bind.

If your bind server (and /etc/resolv.conf for all the other applications) is configured to use specific forwarders, then you can create a rule(s, if there are more than one) like

iptables -A INPUT -p udp -s OTHERDNSSERVER --sport 53 -j ACCEPT

This will permit packets coming from your external DNS server (port 53). If your ISP/host didn't provide you with DNS servers to use and bind is using recursion to look everything up, then the responses could be coming from anywhere. In that case you'd use conntrack:

iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT

This permits responses to outbound connections. If you have a lot of DNS queries, you may have to increase the conntrack table size or decrease its timeout.

3
  • These random ports for incoming DNS responses, are they within a certain range? If I allowed that range, wouldn't that be circumventing the whole point of having a firewall in the first place? Nov 21, 2010 at 21:01
  • @BuckFilledPlatypus The conntrack option only allows packets that look like they're responding to the packets you sent. The OTHERDNSSERVER option is specifically for UDP from (source port 53) the DNS daemon on the server. In either case, you'll have to assume that the DNS server you're getting a response from has not been subverted and that it's response is not dangerous.
    – DerfK
    Dec 1, 2010 at 3:14
  • Stumbled across this response because I was having massive slowdown with making SSH connections. Time out before making the change was 29s. The first iptables command dropped it to 7s. The second to zero. The only change was that I added "-p udp --sport 53 -i WANPORT". Seems that if you don't control the upstream DNS server, then chaining is more likely than not to happen.
    – CyberFonic
    May 21, 2013 at 5:37
3

Add a logging rule to see what's getting dropped:
iptables -A INPUT -j LOG

The slowdown is quite possibly caused by timeouts to some port you've forgotten about.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .