Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My LAMP webserver started lagging while serving up pages. After poking around I noticed iptables -L was taking a good 2-5 seconds to complete - I'm used to this happening a lot quicker.

So I restarted iptables and it fixed my lag problem.

Question: is it bad practice to restart iptables on a regular basis?

I know it disables the firewall so I'm unprotected for a matter of seconds, but it seems that after about a week of running time the iptables -L command tends to take longer and longer to execute. So I figured a weekly cron would suffice, but wanted to know if this was a bad idea. Instead there may be a iptables specific conf option I should be setting instead?

share|improve this question
3  
It should not be necessary, the netstat -L output is almost certainly lagging because you didn't provide the -n option to disable reverse DNS. –  Zoredache Feb 20 '12 at 22:55
    
@Zoredache Please put that in an answer so I can accept, thanks! –  bMon Feb 22 '12 at 2:43

1 Answer 1

There is nothing inherent in the iptables command that should take that long. You didn't say how you restarted iptables (even though that is not an accurate phrase) - but I'll assume you did this:

# service iptables restart

If this is true, then you are using Red Hat Enterprise Linux or something similar (you didn't say).

The documentation for iptables -L says this:

Please note that [this option] is often used with the -n option, in order to avoid long reverse DNS lookups.

Try using iptables -L -v -n (a favorite invocation of mine) to display the details of your rules.

This does not I would guess relate to your web server lag problem. You didn't say what web server, what operating system, what symptoms, etc. Your web server lag should not be related to any lag of the display of firewall rules. However, reverse DNS can bite there too: check for configuration that turns off reverse DNS lookups.

share|improve this answer
    
One of my keywords is "centos", so yes I did say it was RHEL, but no I didn't say it was 5.x. I said it was a LAMP configuration, so I did say it was an Apache web server. I did say it was lagging serving up pages, which I figured was enough because my question was about restarting iptables. But yes, the -n option is the reason it was taking awhile. –  bMon Feb 22 '12 at 2:42

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.