1

When I run sudo iptables -L, I get:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
REJECT     tcp  --  anywhere             anywhere            tcp dpt:www flags:FIN,SYN,RST,ACK/SYN #conn/32 > 20 reject-with tcp-reset

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

What does this mean? I am pretty new to the whole Ubuntu world. I cannot access webmin at times, keep getting The connection has timed out error.

2 Answers 2

4

This rule limits the number of parallel connections coming from a single IP to your webserver. In this case no more than 20 parallel connections from a single IP are allowed.

Usually rules like these are used to protect against DoS attacks.

Given a browser which opens a new connection for every image included in the HTML file you might easily exceed this limit.

4
  • Could this affect webmin? How can I increase the max connections? Any better ways of preventing DoS attacks?
    – Churchill
    Dec 12, 2012 at 17:25
  • Sure it could as webmin works with many images (icons). I don't use webmin for administration so i can't tell you how and where to increase that number. Are you really running a site where you have to be concerned about DoS attacks? If so you have to find out how to increase that number. I don't know about other ways to protect against DoS as this one is very effective. Dec 12, 2012 at 17:30
  • 2
    Just read that your webmin is running on port 10000. Then this rule shouldn't be the cause of your problems. Anyway, you could iptables -F to get rid of that rule and check if it makes a difference... Dec 12, 2012 at 17:36
  • Browsers in general don't open new connections to a webserver for every resource. See this question on StackOverflow.
    – gertvdijk
    Dec 13, 2012 at 13:16
2

That firewall rule prevents a particular type of attack against your computer, and wouldn't have anything to do with being unable to access a web-based tool.

An occassional "connection timed out" message generally means there is something wrong with the network you're using, or with the webserver hosting webmin.

The only way the above rule would be affecting you is if you're running webmin on your own computer - is that the case?

[edited to be more specific/accurate]

5
  • So this does not affect port :10000 which is used for webmin? Cool. Any tools I can use to check what is causing the outtages?
    – Churchill
    Dec 12, 2012 at 17:26
  • 1
    ??? I read dpt:www so this rule should only affect the port which is listed as www in /etc/services... usually port 80. Dec 12, 2012 at 17:41
  • I am connecting to the server remotely from my desktop machine.
    – Churchill
    Dec 12, 2012 at 18:16
  • @Andy Friese, you're right, I missed that bit. If webmin is running on port 10000 though, this rule really wouldn't apply. Dec 12, 2012 at 19:13
  • Yeah, that's strange. Just a very wild guess: images might get loaded over 80 as they don't contain sensitive information. 10000 is for sensitive stuff via SSL... Anyway, the OP seems to has resolved his issue so I don't care :) Dec 12, 2012 at 19:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .