1

I use Ubuntu Server as my router/firewall for my network for a number of reasons. Until recently, I was using 10.04 with great success for this purpose. The OS provides DNS lookup and DHCP using DNSMasq. I recently set up a new install with Ubuntu 12.04, since 10.04 support has ended.

The server supplies dns, routing, and dhcp.

My configuration is pretty straightforward.

/etc/network/interfaces

auto eth0 eth1
iface eth0 inet dhcp #WAN connection
iface eth1 inet static #LAN connection
        address 192.168.16.1
        netmask 255.255.255.0
        network 192.168.16.0
        broadcast 192.168.16.255

iptables commands (routing is enabled in the kernel)

iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -t raw -F
iptables -t raw -X
iptables -A FORWARD -i eth1 -s 192.168.16.0/255.255.255.0 -j ACCEPT
iptables -A FORWARD -i eth0 -d 192.168.16.0/255.255.255.0 -j ACCEPT
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP
iptables -I INPUT 1 -i lo -j ACCEPT
iptables -I INPUT 1 -i eth1 -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

Relevant (non-default) /etc/dnsmasq.conf entries

listen-address=192.168.16.1
strict-order
interface=eth1
dhcp-range=192.168.16.100,192.168.16.199,72h

And finally, /etc/resolvconf/resolv.conf.d/tail

nameserver 97.64.168.12
nameserver 8.8.8.8

With the exception of the resolv.conf changes in Ubuntu 12.04, this is pretty much identical to my setup in 10.04. However, all devices on my network are subject to a very long (2+ second) TTFB delay when browsing the internet, except for a mostly immediate refresh of the page. Essentially, the first request for a page has this delay, but subsequent requests within a minute are served immediately (including with a CTRL-F5 cache-ignoring request). However, wait a minute or so, and refreshing the page, or really any request to any outside resource, will again take it's time.

At first, I expected this to be a problem with the DNS resolver, and approached it as such. However the browser dev tools clearly indicate that the dns request is near immediate compared to the TTFB time.

This is the graph for a typical request to google.com: TTFB Browser Graph

Again, this configuration has worked flawlessly for years on Ubuntu 10.04, but with 12.04, attempted on both the same and different hardware with multiple fresh installs, this behavior is constant and predictable.

I know it's a bit odd to use Ubuntu as a firewall/router, but it serves several other purposes to which it is well suited. Right now, however, this is a clean installation supplying only these roles to my network.

  • Ubuntu should be ok at that job, I dont think that is the problem. Are there any outstanding updates to your installation ? – LenW Jul 20 '15 at 16:19
  • Everything is fully upgraded, nothing pending except for landscape-common, held back. The HWE Stack is also current, stating support through April 2017. I've even removed and rebuilt the repository lists, all defaults. – SuperJer Jul 20 '15 at 16:27
  • So it would seem that the best strategy for fixing this issue in Ubuntu 12.04 is to skip it all together and go with 14.04. I wish I knew why. I'll leave this question up to see if anyone has an answer. I prefer 12 over 14 for most stuff, but that mostly applies to other server-related stuff, not routing/firewalls. – SuperJer Jul 21 '15 at 0:47
  • Does 14 solve the problem? That would be interesting – LenW Jul 21 '15 at 5:00
  • It seems to have fixed it. I wish I could explain it. I've been using it heavily since posting that comment yesterday without a single issue. – SuperJer Jul 22 '15 at 5:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.