2

For some reason when I try to run sudo iptables -L it takes a very long time to load. I am loading the rules from a script and it's on an Ubuntu server virtual machine through VMWare Fusion with 2MB dedicated RAM. I've also occasionally been getting other errors such as "Another app is currently holding the xtables lock. Perhaps you want to use the -w option?" when I try to run the script of sudo iptables -L. This error tends to go away on restart of the server but sometimes when I come back my script is corrupted. I have not yet received this error after making certain modifications to the code.

I can only post partial code of my script because this is a homework assignment, but solving this issue is NOT part of the assignment.

#flushing all the rules
iptables --flush
iptables -X

iptables --policy INPUT DROP
iptables --policy OUTPUT ACCEPT
iptables --policy FORWARD DROP

iptables -A INPUT -i lo -j LOG --log-prefix "LOOPBACK IN : "
iptables -A OUTPUT -o lo -j LOG --log-prefix "LOOPBACK OUT: "
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j LOG --log-prefix "Established-IN"
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j LOG --log-prefix "Established-OUT"

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT


...specific port acceptance per IP address, no NEW states (not sure if relevant)...

iptables -A INPUT -s $LOCAL_NETWORK -d $SERVER_IP -j LOG --log-prefix "Unauthorized local    connection: "

iptables -A INPUT -s $LOCAL_NETWORK -d $SERVER_IP -j REJECT
0

1 Answer 1

6

iptables -L by default will try to resolve IP addresses to hostnames.

I have a small iptables ruleset on this one system here, but it does take a while to get through even that small list because of the rules.

By using iptables -L -n, it displays everything numerically and skips IP resolution and port service common name display. It should also display faster. (The -n option tells it to show numerical entries for everything and will NOT try and resolve IPs. The downside is, ports will also be displayed numerically, rather than http for port 80 for example.)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .