Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

So I implemented some a different set of iptables rules and now if i enable them, then lighttpd simply takes forever to load php enabled pages(like wp). There is no load on the server, processor usage stays low.

Here is my config, what could be the cause of this ?

*filter

:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:fail2ban-ssh - [0:0]
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 2012 -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 1194 -j ACCEPT 
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT 
-A INPUT -i lo -j ACCEPT 


-A OUTPUT -j ACCEPT 

-A INPUT -j DROP 
COMMIT

share|improve this question

4 Answers 4

up vote 5 down vote accepted

You're missing a rule to accept traffic based on existing traffic (the rule that makes iptables stateful). This should be your very first rule:

-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
share|improve this answer

You're blocking incoming DNS responses, and apparently lighttpd (or wp) is configured to resolve IP addresses to hostnames.

You should be able to fix this with something like

-A INPUT -p udp -m udp --sport 53 -j ACCEPT

since the UDP packets for DNS responses originate from port 53.

share|improve this answer
    
You gave him the fish, now he won't learn to solve it right but just copy/paste. You're disallowing him from hacking to hell, this was not a humbling experience to me... –  Tom Wijsman Aug 11 '12 at 13:55
    
@TomWijsman eh, it's just the most glaring mistake, it's probably not even the only one. –  DerfK Aug 11 '12 at 15:44

As the details about the complete setup are not known, then i can suggest you to to following. Just before the Drop rule, add a rule to LOG all traffic. Then check your syslog logs for those packets which are being dropped. You will know that what type of packets are being dropped or denied, then you can create a rule based on those types of packets to be allowed.

share|improve this answer

The cause is missing comments and logging:

  • Can you tell what each line does in about a month of now?

  • Did you compare the log of your iptables firewall before and after you put this into effect?

Those two questions should help you find the issue, you're blocking something too much...

share|improve this answer
    
:P Use google damit !! and iptables is not a firewall –  HackToHell Aug 11 '12 at 12:46
1  
iptables is a user space application program that allows a system administrator to configure the tables provided by the Linux kernel firewall, your turn again? –  Tom Wijsman Aug 11 '12 at 13:54
    
It's a program to configure the firewall so its not a firewall ;p –  HackToHell Aug 11 '12 at 15:02
    
@HackToHell: I never said it was, you're using a firewall that is using iptables... ;) –  Tom Wijsman Aug 11 '12 at 15:15

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.