Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

It took a lot of time and digging to get my ipTables working fairly well.

Current status: 'Works' w/ a noticeable, reproducible (almost unacceptable) delay on SSH connections. This delay goes away as soon as ipTables is disabled. Please help, how can I fight off the long list of potential attacks, and also get my fast ssh back?

-A INPUT -i lo -j ACCEPT 
#DROP fragments (from a *different* tutorial, do I need this?)
-A INPUT -f -j DROP 
-A INPUT -p tcp ! --syn -m state --state NEW -j DROP 
-A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP 
-A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
-A INPUT -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP 
-A INPUT -p tcp --tcp-flags ALL FIN -j DROP 
#DROP NULL SCANS              
-A INPUT -p tcp --tcp-flags ALL NONE -j DROP  
#DROP ALL/ALL SCANS            
-A INPUT -p tcp --tcp-flags ALL ALL -j DROP               
#non-standard ssh port matches ssh config
-A INPUT -p tcp -m tcp --dport x1x0 -j ACCEPT  
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT 

Thank you

EDIT: I dug deeper and my ISP's nameservers and DNS look-up might be the problem:

Why would the SSH server be doing a DNS look-up, when I'm connecting as

and / or

Can I fix this (if DNS look-up is the cause) w/ an adjustment to the ssh config, instead of messing with having to find out the ip of the ISP's nameservers?

share|improve this question
What does ssh -v say? – Ignacio Vazquez-Abrams Jan 29 '11 at 8:04
OpenSSH_4.3p2, OpenSSL 0.9.8e-fips-rhel5 01 Jul 2008 usage: ssh... – This_Is_Fun Jan 29 '11 at 8:29
up vote 2 down vote accepted

If the hang is caused when you login then it is probably related to the sshd UseDNS configuration parameter. The default for this is yes so sshd does a lookup on your client's hostname and then checks that it maps back to the IP address that is is seeing on the inbound connection.

You'll probably find that you don't have a suitable DNS PTR record for your client.

Try setting

UseDNS no

in your /etc/ssh/sshd_config file then restart sshd.

share|improve this answer
Perfect, I should have looked there already, but I've been "smashing my head on the firewall" for way too long. THANKS lain! – This_Is_Fun Jan 29 '11 at 9:53

Here is a basic gist of what I am doing, It's commented and I've never seen any connection slowdowns. But, make sure you have console access before mucking with firewall rules :)

share|improve this answer
Thanks slillibri, I tried several variations on your udp related code and failed to get it working. In "a few months" your set-up might be a "gold-mine of info," but right now I need a format more like the one posted above. – This_Is_Fun Jan 29 '11 at 9:39

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.