Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How to optimize iptables for high DNS traffic? I have a dedicated linux server acting as bridged firewall using iptables. Recently behind firewall was deployed DNS server with high load and firewall began to work slow. Some tips, how to make firewall more effective?

share|improve this question

3 Answers 3

up vote 5 down vote accepted

You should not log the allowed traffic rules, to avoid excessive logs (and so time to write logs). dns packets are small, but in outstanding numbers. You firewall may not be able to handle that number of packets per second.

does ifconfig -a reports dropped/errors/overruns/collisions ?

You can use iptraf to get the number of packets per size distribution:

iptraf -i eth0 -z eth0

You can add cpu affinity per ethernet card, to raise up the number of pps it can handle

You could be exhausting the connections table. You can use the NOTRACK option so DNS traffic won't be retain in connection tables, thus improving perf.

share|improve this answer

If you suspect iptables is burning a lot of CPU with DNS traffic, I'd suggest reorganizing the rules so that you exit the firewall tables ASAP.

Put the DNS rules at the very top of the appropriate table.

share|improve this answer

Because of the high number of connexions, if you don't need conntrack you can disable it :

iptables -t raw -I PREROUTING -j NOTRACK

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.