I use Ubuntu Server as my router/firewall for my network for a number of reasons. Until recently, I was using 10.04 with great success for this purpose. The OS provides DNS lookup and DHCP using DNSMasq. I recently set up a new install with Ubuntu 12.04, since 10.04 support has ended.

The server supplies dns, routing, and dhcp.

My configuration is pretty straightforward.


auto eth0 eth1
iface eth0 inet dhcp #WAN connection
iface eth1 inet static #LAN connection

iptables commands (routing is enabled in the kernel)

iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -t raw -F
iptables -t raw -X
iptables -A FORWARD -i eth1 -s -j ACCEPT
iptables -A FORWARD -i eth0 -d -j ACCEPT
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -I INPUT 1 -i lo -j ACCEPT
iptables -I INPUT 1 -i eth1 -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

Relevant (non-default) /etc/dnsmasq.conf entries


And finally, /etc/resolvconf/resolv.conf.d/tail


With the exception of the resolv.conf changes in Ubuntu 12.04, this is pretty much identical to my setup in 10.04. However, all devices on my network are subject to a very long (2+ second) TTFB delay when browsing the internet, except for a mostly immediate refresh of the page. Essentially, the first request for a page has this delay, but subsequent requests within a minute are served immediately (including with a CTRL-F5 cache-ignoring request). However, wait a minute or so, and refreshing the page, or really any request to any outside resource, will again take it's time.

At first, I expected this to be a problem with the DNS resolver, and approached it as such. However the browser dev tools clearly indicate that the dns request is near immediate compared to the TTFB time.

This is the graph for a typical request to google.com: TTFB Browser Graph

Again, this configuration has worked flawlessly for years on Ubuntu 10.04, but with 12.04, attempted on both the same and different hardware with multiple fresh installs, this behavior is constant and predictable.

I know it's a bit odd to use Ubuntu as a firewall/router, but it serves several other purposes to which it is well suited. Right now, however, this is a clean installation supplying only these roles to my network.

  • Ubuntu should be ok at that job, I dont think that is the problem. Are there any outstanding updates to your installation ?
    – LenW
    Jul 20, 2015 at 16:19
  • Everything is fully upgraded, nothing pending except for landscape-common, held back. The HWE Stack is also current, stating support through April 2017. I've even removed and rebuilt the repository lists, all defaults.
    – Jerbot
    Jul 20, 2015 at 16:27
  • So it would seem that the best strategy for fixing this issue in Ubuntu 12.04 is to skip it all together and go with 14.04. I wish I knew why. I'll leave this question up to see if anyone has an answer. I prefer 12 over 14 for most stuff, but that mostly applies to other server-related stuff, not routing/firewalls.
    – Jerbot
    Jul 21, 2015 at 0:47
  • Does 14 solve the problem? That would be interesting
    – LenW
    Jul 21, 2015 at 5:00
  • It seems to have fixed it. I wish I could explain it. I've been using it heavily since posting that comment yesterday without a single issue.
    – Jerbot
    Jul 22, 2015 at 5:04


You must log in to answer this question.

Browse other questions tagged .