2

So I implemented some a different set of iptables rules and now if i enable them, then lighttpd simply takes forever to load php enabled pages(like wp). There is no load on the server, processor usage stays low.

Here is my config, what could be the cause of this ?

*filter

:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:fail2ban-ssh - [0:0]
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 2012 -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 1194 -j ACCEPT 
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT 
-A INPUT -i lo -j ACCEPT 


-A OUTPUT -j ACCEPT 

-A INPUT -j DROP 
COMMIT

9

You're missing a rule to accept traffic based on existing traffic (the rule that makes iptables stateful). This should be your very first rule:

-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
  • 4
    Note that this can be further adapted to -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT. I've discovered that conntrack is more preferred in recent kernels, with state being a fallback. – Thomas Ward Nov 30 '15 at 0:11
7

You're blocking incoming DNS responses, and apparently lighttpd (or wp) is configured to resolve IP addresses to hostnames.

You should be able to fix this with something like

-A INPUT -p udp -m udp --sport 53 -j ACCEPT

since the UDP packets for DNS responses originate from port 53.

  • You gave him the fish, now he won't learn to solve it right but just copy/paste. You're disallowing him from hacking to hell, this was not a humbling experience to me... – Tamara Wijsman Aug 11 '12 at 13:55
  • @TomWijsman eh, it's just the most glaring mistake, it's probably not even the only one. – DerfK Aug 11 '12 at 15:44
1

As the details about the complete setup are not known, then i can suggest you to to following. Just before the Drop rule, add a rule to LOG all traffic. Then check your syslog logs for those packets which are being dropped. You will know that what type of packets are being dropped or denied, then you can create a rule based on those types of packets to be allowed.

0

The cause is missing comments and logging:

  • Can you tell what each line does in about a month of now?

  • Did you compare the log of your iptables firewall before and after you put this into effect?

Those two questions should help you find the issue, you're blocking something too much...

  • 1
    iptables is a user space application program that allows a system administrator to configure the tables provided by the Linux kernel firewall, your turn again? – Tamara Wijsman Aug 11 '12 at 13:54
  • It's a program to configure the firewall so its not a firewall ;p – HackToHell Aug 11 '12 at 15:02
  • @HackToHell: I never said it was, you're using a firewall that is using iptables... ;) – Tamara Wijsman Aug 11 '12 at 15:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.