Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a KVM host which bridges its eth0 as br0. I have one guest which uses the bridge adapter (rather than NAT) with its own public IP.

If I setup basic firewall rules on the host, it suddenly begins taking a long time to connect to ssh (or other services, such as http) the guest on its IP - whether locally (from the host) or from another host entirely. Long time I mean maybe 20 seconds instead of 1 second. Also its outbound connections take a long time to open as well (connecting from guest to another host).

I simply have all forwarding enabled for simplicity; without that statement no traffic is getting to or from the guest. If I flush all these rules, then connectivity returns to normal.

Questions: 1. What gives? 2. How to troubleshoot further - is there a way to log all rejections?

These are my rule statements:


#  Allow all loopback (lo0) traffic and drop all traffic to 127/8 that doesn't use lo0
-A INPUT -i lo -j ACCEPT
-A INPUT ! -i lo -d -j REJECT

#  Accept all established inbound connections

#  Allow all outbound traffic - you can modify this to only allow certain traffic

# Forward all traffic through the bridge interface 

#  Allow HTTP and HTTPS connections from anywhere (the normal ports for websites and SSL).
-A INPUT -p tcp --dport 80 -j ACCEPT
-A INPUT -p tcp --dport 443 -j ACCEPT
#allow check_nrpe & check_mk
-A INPUT -p tcp --dport 5666 -j ACCEPT
-A INPUT -p tcp --dport 6556 -j ACCEPT
-A INPUT -p tcp --dport 2220 -j ACCEPT

#  Allow SSH connections
#  The -dport number should be the same port number you set in sshd_config
-A INPUT -p tcp -m state --state NEW --dport 22 -j ACCEPT

#  Allow ping
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT

#  Log iptables denied calls
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7

#  Reject all other inbound - default deny unless explicitly allowed policy

share|improve this question
up vote 1 down vote accepted

Did you setup the services to try to reverse DNS incoming connections (as is the default often with ssh), then proceed to block DNS queries via your firewall rules?

share|improve this answer
Of course I did! The kvm host runs dnsmasq and uses the local nameserver as the first in the list. I should have realized this but hadn't thought of the RDNS explanation. Thanks! – Jeremy May 6 '12 at 21:36

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.