Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When I add iptables rules to the server (on a local network), the connection becomes very slow. This is confirmed for both SSH (logging in goes much slower), and MySQL (websites use this server as their MySQL database server, and this connection is also very slow). The odd thing is, AFAIK there are no rules set that limit the speed in any way. I'm only restricting access. This is the ruleset:

$ iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     tcp  --  localnet/24          anywhere            tcp dpt:www 
ACCEPT     tcp  --  localnet/24          anywhere            tcp dpt:mysql 
ACCEPT     tcp  --  localnet/24          anywhere            tcp dpt:22
DROP       all  --  anywhere             anywhere            

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  localnet/24          anywhere            ctstate NEW 
ACCEPT     all  --  anywhere             anywhere            ctstate RELATED,ESTABLISHED 

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Note: in addition to SSH and MySQL, I also limit access to Apache, as can be seen. This is not slowed down and appears to be working just fine. And to give an indication of what is slow: connecting to SSH hangs for 10-15 seconds before continuing, and establishing a MySQL will slow down webpages about 15-60 seconds.

Note 2: these are all the iptables rules in the firewall (FORWARD rules are there to share internet). If I simply flush it, SSH/MySQL become instantly responsive.

share|improve this question
up vote 4 down vote accepted

It almost sounds like DNS queries are not succeeding and timing out. You might need a RELATED,ESTABLISHED rule in your INPUT chain to allow DNS responses to get back to your SSH and MySQL servers.

share|improve this answer
Superb, that was exactly the case! Thanks! – user60129 Oct 24 '11 at 14:08

I found solution from another Answer add RELATED,ESTABLISHED rule

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

reason I faced same problem I changed iptables policy to reject to connection

iptables --policy INPUT DROP 

^^ this cause the problem and the above code solve it .

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.