[no subject]

iptables -A INPUT -p udp -m state --state RELATED,ESTABLISHED -j ACCEPT


Quoting Christopher Bergeron <christopher at bergeron.com>:

> I tried it with dns on udp, but it still does the same thing.
> 
> Here are my rules:
> iptables -P INPUT DROP                   #drop everything by default
> iptables -P OUTPUT ACCEPT           #let anything out
> 
> # allow some incoming requests
> iptables -A INPUT -p tcp --dport 22 -j ACCEPT
> iptables -A INPUT -p udp --dport 53 -j ACCEPT
> iptables -A INPUT -p tcp --dport 80 -j ACCEPT
> iptables -A INPUT -p tcp --dport 3306 -j ACCEPT
> 
> 
> When these rules are enabled, the pages take about 10 seconds to load.
> When the rules are disabled, the pages display almost instantly.
> 
> Anyone have any ideas?
> Thanks again,
> CB
> 
> 
> 
> 
> 
> Stephan Uphoff wrote:
> 
> >Try adding udp for dns.
> >
> >Christopher Bergeron wrote:
> >  
> >
> >>Does anyone know why the usage of iptables could slow down a webserver?
> >>
> >>My website uses mysql, httpd, and dns.
> >>
> >>My rules are similar to the following:
> >>
> >>DROP all INPUT by default
> >>let any output flow (OUTPUT ACCEPT)
> >>INPUT from dns accepted (INPUT -p tcp -j ACCEPT)
> >>INPUT from httpd accepted (INPUT -p tcp -j ACCEPT)
> >>INPUT from mysql accepted (INPUT -p tcp -j ACCEPT)
> >>
> >>I'm no iptables guru, but my rules make sense (at least to me).  Is 
> >>there something that I'm missing?
> >>
> >>Thanks in advance,
> >>CB
> >>
> >>
> >>
> >>_______________________________________________
> >>Ale mailing list
> >>Ale at ale.org
&gt; &gt;&gt;<a  rel="nofollow" href="http://www.ale.org/mailman/listinfo/ale";>http://www.ale.org/mailman/listinfo/ale</a>
&gt; &gt;&gt;
&gt; &gt;&gt;    
&gt; &gt;&gt;
&gt; &gt;
&gt; &gt;
&gt; &gt;_______________________________________________
&gt; &gt;Ale mailing list
&gt; &gt;Ale at ale.org
&gt; &gt;<a  rel="nofollow" href="http://www.ale.org/mailman/listinfo/ale";>http://www.ale.org/mailman/listinfo/ale</a>
&gt; &gt;
&gt; &gt;
&gt; &gt;  
&gt; &gt;
&gt; 
&gt; 
&gt; _______________________________________________
&gt; Ale mailing list
&gt; Ale at ale.org
&gt; <a  rel="nofollow" href="http://www.ale.org/mailman/listinfo/ale";>http://www.ale.org/mailman/listinfo/ale</a>
&gt; 
&gt; 


-- 
Frank S. Glass
Holos Software, Inc.
770.496.1877

-------------------------------------------------
Holos Software, Inc. <a  rel="nofollow" href="http://holos.com";>http://holos.com</a>


</pre>
<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->
<hr>
<!--X-Follow-Ups-End-->
<!--X-References-->
<ul><li><strong>References</strong>:
<ul>
<li><strong><a name="00446" href="msg00446.html">[ale] iptables slowing down the website?</a></strong>
<ul><li><em>From:</em> ups at tree.com (Stephan Uphoff)</li></ul></li>
<li><strong><a name="00449" href="msg00449.html">[ale] iptables slowing down the website?</a></strong>
<ul><li><em>From:</em> christopher at bergeron.com (Christopher Bergeron)</li></ul></li>
</ul></li></ul>
<!--X-References-End-->
<!--X-BotPNI-->
<ul>
<li>Prev by Date:
<strong><a href="msg00449.html">[ale] iptables slowing down the website?</a></strong>
</li>
<li>Next by Date:
<strong><a href="msg00451.html">[ale] FBI wants to tap broadband lines</a></strong>
</li>
<li>Previous by thread:
<strong><a href="msg00449.html">[ale] iptables slowing down the website?</a></strong>
</li>
<li>Next by thread:
<strong><a href="msg00448.html">[ale] Grub and XP tablet edition</a></strong>
</li>
<li>Index(es):
<ul>
<li><a href="maillist.html#00450"><strong>Date</strong></a></li>
<li><a href="threads.html#00450"><strong>Thread</strong></a></li>
</ul>
</li>
</ul>

<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->
</body>
</html>