Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Here is the output of an "iptables-save":

# Generated by iptables-save v1.4.4 on Sun Nov 21 11:28:56 2010
:INPUT ACCEPT [921:116690]
:OUTPUT ACCEPT [856:343403]
# Completed on Sun Nov 21 11:28:56 2010
# Generated by iptables-save v1.4.4 on Sun Nov 21 11:28:56 2010
:OUTPUT ACCEPT [189:12510]
# Completed on Sun Nov 21 11:28:56 2010
# Generated by iptables-save v1.4.4 on Sun Nov 21 11:28:56 2010
:INPUT DROP [188:58400]
:OUTPUT ACCEPT [856:343403]
-A INPUT -p icmp -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT 
-A INPUT -p udp -m udp --dport 22 -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT 
-A INPUT -p udp -m udp --dport 80 -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 53 -j ACCEPT 
-A INPUT -p udp -m udp --dport 53 -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT 
-A INPUT -p udp -m udp --dport 443 -j ACCEPT 
# Completed on Sun Nov 21 11:2

The server hosts my bind server which is serving as the authoritative nameserver for the particular domain in question. The server also hosts the site itself. What could cause this slowdown when activating iptables rules with these ports open? Am I missing some ports that should allow dns to work correctly?

share|improve this question
up vote 2 down vote accepted

Is your webserver trying to reverse-resolve IP addresses to hostnames? When bind has to either recurse or forward requests, by default (as of bind 8.1) it chooses random ports to make its requests from. Since UDP packets are returned to the port that sent it, they are blocked by this firewall.

You can uncomment

query-source address * port 53;

in the named.conf.options file (on Debian, anyway) to force it to use port 53. Random ports are chosen in order to help prevent cache poisoning attacks (where someone returns a spoofed response packet back to you before the real packet arrives) so it's a good idea to fix the firewall instead of changing bind.

If your bind server (and /etc/resolv.conf for all the other applications) is configured to use specific forwarders, then you can create a rule(s, if there are more than one) like

iptables -A INPUT -p udp -s OTHERDNSSERVER --sport 53 -j ACCEPT

This will permit packets coming from your external DNS server (port 53). If your ISP/host didn't provide you with DNS servers to use and bind is using recursion to look everything up, then the responses could be coming from anywhere. In that case you'd use conntrack:

iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT

This permits responses to outbound connections. If you have a lot of DNS queries, you may have to increase the conntrack table size or decrease its timeout.

share|improve this answer
These random ports for incoming DNS responses, are they within a certain range? If I allowed that range, wouldn't that be circumventing the whole point of having a firewall in the first place? – BuckFilledPlatypus Nov 21 '10 at 21:01
@BuckFilledPlatypus The conntrack option only allows packets that look like they're responding to the packets you sent. The OTHERDNSSERVER option is specifically for UDP from (source port 53) the DNS daemon on the server. In either case, you'll have to assume that the DNS server you're getting a response from has not been subverted and that it's response is not dangerous. – DerfK Dec 1 '10 at 3:14
Stumbled across this response because I was having massive slowdown with making SSH connections. Time out before making the change was 29s. The first iptables command dropped it to 7s. The second to zero. The only change was that I added "-p udp --sport 53 -i WANPORT". Seems that if you don't control the upstream DNS server, then chaining is more likely than not to happen. – CyberFonic May 21 '13 at 5:37

Add a logging rule to see what's getting dropped:
iptables -A INPUT -j LOG

The slowdown is quite possibly caused by timeouts to some port you've forgotten about.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.