Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to improve the performance of my server by tuning iptables to not keep track of TCP connection's state. I'm looking at this guide: http://cotdp.com/2011/07/nginix-on-a-256mb-vm-slice-24000-tps/

However, if I do any of the following it seems like all outgoing connections are cut off:

remove this rule: INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT adding these:

iptables -t raw -I OUTPUT -j NOTRACK
iptables -t raw -I PREROUTING -j NOTRACK

Immediately after making either change makes it so "ping google.com" returns an error about not being able to find "google.com" (ie the DNS stops resolving).

Here are the rules that are loaded up on boot, but other rules are then added by fail2ban:

*filter
-A INPUT -i lo -j ACCEPT
-A INPUT ! -i lo -d 127.0.0.0/8 -j REJECT
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A OUTPUT -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -p tcp --dport ssh -j ACCEPT
-A INPUT -p tcp --dport http -j ACCEPT
-A INPUT -p tcp --dport https -j ACCEPT
-A INPUT -p tcp --dport smtp -j ACCEPT
-A INPUT -p tcp --dport ssmtp -j ACCEPT
-A INPUT -j REJECT
-A FORWARD -j REJECT
COMMIT

Here's the output of iptables --list:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
fail2ban-ssh  tcp  --  anywhere             anywhere            multiport dports ssh 
fail2ban-ssh-ddos  tcp  --  anywhere             anywhere            multiport dports ssh 
fail2ban-pam-generic  tcp  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
REJECT     all  --  anywhere             loopback/8          reject-with icmp-port-unreachable 
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     icmp --  anywhere             anywhere            
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ssh 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:www 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:https 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:smtp 
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ssmtp 
REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable 

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable 

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            

Chain fail2ban-pam-generic (1 references)
target     prot opt source               destination         
RETURN     all  --  anywhere             anywhere            

Chain fail2ban-ssh (1 references)
target     prot opt source               destination         
RETURN     all  --  anywhere             anywhere            

Chain fail2ban-ssh-ddos (1 references)
target     prot opt source               destination         
RETURN     all  --  anywhere             anywhere            
share|improve this question
1  
If you want to make your firewall stateless, then you need to make your rules stateless. Get rid of the -m state --state ESTABLISHED,RELATED rule, and then add additional explicit rules to handle both incoming and outgoing traffic. –  Zoredache Sep 10 '12 at 16:27
    
@Zoredache - dude! I'm trying to remove the state dependent rules, but removing them is causing troubles... hence the point of my question! –  Tim Tisdall Sep 10 '12 at 16:30
    
You have no rule to allow incoming DNS traffic and DNS doesn't work. What's your question? This is totally unsurprising. (The best way to allow incoming DNS replies is by keeping state. Since you don't want to do that, you'll have to find another way.) –  David Schwartz Sep 10 '12 at 16:30
    
@DavidSchwartz - The DNS is working fine until I change either of the rules mentioned in the question. I don't understand why removing a rule related to TCP input state would suddenly kill DNS. Or telling iptables to stop tracking OUTPUT and PREROUTING would kill DNS. –  Tim Tisdall Sep 10 '12 at 16:33
    
Think about what stateful tracking is doing for you. It allows you to permit things based on the state of the connection. Your incoming traffic was permitted because of the state. If you disable state tracking, then you must explicitly create rules for everything. –  Zoredache Sep 10 '12 at 16:36
show 1 more comment

1 Answer 1

up vote 2 down vote accepted

You have a rule which blocks all incoming traffic:

-A INPUT -j REJECT

And you stop connection tracking, so the rule to accept established connections' packets doesnt work anymore:

-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

So your DNS packet goes out, is not tracked, and is then rejected by the first rule.

You need to enable tracking for the second rule to work, or add rules to allow incoming traffic from "good" sources.

share|improve this answer
    
Okay, maybe my problem is my misunderstanding of how DNS works. Aren't DNS lookups done by sending a request that would be handled by an OUTPUT rule? –  Tim Tisdall Sep 10 '12 at 16:40
6  
yes, but you need a reply ofcourse, which is handlede by the INPUT rule. So the DNS server gets your request, sends the reply back, and you reject it. –  mulaz Sep 10 '12 at 16:42
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.