ipfw based firewall slows down Apache web server

Question

I have an Apache web server running on a FreeBSD 8.3 machine.
That machine has an ipfw firewall with these rules:

root@aigamedev:~# ipfw -a list
00005    0       0 deny ip from 67.212.xxx.xxx to any
00010  206   88422 allow ip from any to any via lo0
00015    0       0 deny ip from any to 127.0.0.0/8
00020    0       0 deny ip from 127.0.0.0/8 to any
00050    0       0 check-state
00060 5315 1358507 allow tcp from any to any established
00061    8     658 allow ip from any to any out keep-state
00070    0       0 allow icmp from any to any
00080    0       0 deny ip from me to me in recv re0
00085    0       0 deny tcp from any to any frag
00098    0       0 allow tcp from me to 83.64.xxx.xxx out established keep-state
00099    0       0 allow tcp from 83.64.xxx.xxx to me dst-port 22 in setup keep-state
00100    0       0 allow tcp from any to any dst-port 22 in setup keep-state
00110    0       0 allow tcp from any to any dst-port 22 out setup keep-state
00160    0       0 allow tcp from any to any dst-port 25 out setup keep-state
00180    0       0 allow tcp from any to any dst-port 53 out setup keep-state
00185    0       0 allow udp from any to any dst-port 53 out keep-state
00200 6750  661150 allow tcp from any to any dst-port 80,443 in setup keep-state
00210    0       0 allow tcp from any to any dst-port 80,443 out setup keep-state
00250    0       0 allow udp from any to any dst-port 123 out keep-state
00280    0       0 allow udp from any to any dst-port 67-68 out keep-state
00300    0       0 allow tcp from any to any dst-port 5222,5223,5269 in setup keep-state
00305    0       0 allow tcp from any to any dst-port 5222,5223,5269 out setup keep-state
00999   25    1716 deny ip from any to any
65535    0       0 deny ip from any to any

As soon as I enable these firewall rules the Apache server on the same machine "slows down", i.e. many connections hang, pages take seconds to load instead of ms. This can be tested from different source networks and clients. In server-status I can see many (most) of the Apache slots in reading state and doing nothing.

When I then stop the firewall the Apache server immediatelly comes back to normal performance again.

Any ideas what could be wrong with these firewall rules?

Answer 1

are you allowing tcp/80 "new" connections? what port is apache listening on, and where should connections be accepted from?

these rules shouldnt be causing any slowdown:

00200 allow tcp from any to any dst-port 80,443 in setup keep-state
00210 allow tcp from any to any dst-port 80,443 out setup keep-stat

---

perhaps these ports are taxing on the scripts/dameons/applicaitions listening on these ports, and are slowing down the box.

00300 allow tcp from any to any dst-port 5222,5223,5269 in setup keep-state
00305 allow tcp from any to any dst-port 5222,5223,5269 out setup keep-state

my advise: have one physical/virtual machine per service..... run ntop to see how much traffic you are actually pushing

Answer 2

It sounds like Apache has a dependency on other services which the firewall is blocking. Without knowing what applications you're running, it's difficult to give more exact info, but you're blocking access to everything on localhost which seems wrong.

Start by commenting out all of the deny lines and make sure that it works at the same speed. Then slowly start re-adding the deny lines, starting from the end. Even though these rules claim to not be being triggered, this is not always as reliable as it could be.