Iptables causing ssh to stall?

Question

I have a server running several VMs via two bridges and want to secure the host via iptables.

So I have the defaults for IN/OUTPUT: drop and FORWARD: accept, and some IN/OUTPUT rules to allow me ssh access.

Now the Problem is with this setup that ssh-sessions are seemingly freezing when a command produces some lines of output. For example date works, but iptables -L or top will hang in the middle of their output. I can kill the session with ~., login again, set iptables back to default and everything works again.

Also after setting the iptables rules it takes a while before the problem arises. I haven't been able to determine the exact timeframe, has been between 5-20 minutes i think.

Any idea what could cause such a problem or how one would go about diagnosing it?

Answer 1

Try running iptables -L -n (add the -n option). Name resolution can cause iptables -L to hang.

Answer 2

Are you blocking ICMP completely? If so, you may have created a PMTU black hole.

Answer 3

Do you have a iptable rule to allow established traffic through?

iptables -A OUTPUT -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

I've also seen this issue due to a split horizon on the network but that doesn't sound like your issue due to the issue going away when you remove the iptable rules