I'm starting with an empty iptables structure, all tables and chains are the default ones with the
ACCEPT default policy. Steps to reproduce:
iptables -I INPUT -s 192.168.0.1/24 -j ACCEPT iptables -L
at this point I get the following output (other chains remain unchanged, so I'm skiping them):
Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT all -- 0.0.168.192.in-addr.arpa/24 anywhere
The output is printed without any issyes. Then I add a DROP rule:
iptables -I INPUT 2 -j DROP iptables -L
Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT all -- 192.168.0.0/24 anywhere DROP all -- anywhere anywhere
iptables -L makes the output to be printed with a huge delay (25-30 seconds) between the first two header lines and the rules themselves.
Questions: Why adding a DROP rule makes the
-L command to run with a delay in the middle? (yes, I know that a it tries to do a reverse DNS lookup, but why after adding a DROP rule and not after adding the
-s 192.168.0.1/24 -j ACCEPT one?)
And why there are different outputs of the source?
0.0.168.192.in-addr.arpa/24 before adding DROP, and
And yes, I've found and read iptables -L pretty slow. Is this normal?. Using
-n makes the output to be printed wihtout delays.