Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When I run sudo iptables -L, I get:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
REJECT     tcp  --  anywhere             anywhere            tcp dpt:www flags:FIN,SYN,RST,ACK/SYN #conn/32 > 20 reject-with tcp-reset

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

What does this mean? I am pretty new to the whole Ubuntu world. I cannot access webmin at times, keep getting The connection has timed out error.

share|improve this question
up vote 4 down vote accepted

This rule limits the number of parallel connections coming from a single IP to your webserver. In this case no more than 20 parallel connections from a single IP are allowed.

Usually rules like these are used to protect against DoS attacks.

Given a browser which opens a new connection for every image included in the HTML file you might easily exceed this limit.

share|improve this answer
Could this affect webmin? How can I increase the max connections? Any better ways of preventing DoS attacks? – Churchill Dec 12 '12 at 17:25
Sure it could as webmin works with many images (icons). I don't use webmin for administration so i can't tell you how and where to increase that number. Are you really running a site where you have to be concerned about DoS attacks? If so you have to find out how to increase that number. I don't know about other ways to protect against DoS as this one is very effective. – Andy Friese Dec 12 '12 at 17:30
Just read that your webmin is running on port 10000. Then this rule shouldn't be the cause of your problems. Anyway, you could iptables -F to get rid of that rule and check if it makes a difference... – Andy Friese Dec 12 '12 at 17:36
Browsers in general don't open new connections to a webserver for every resource. See this question on StackOverflow. – gertvdijk Dec 13 '12 at 13:16

That firewall rule prevents a particular type of attack against your computer, and wouldn't have anything to do with being unable to access a web-based tool.

An occassional "connection timed out" message generally means there is something wrong with the network you're using, or with the webserver hosting webmin.

The only way the above rule would be affecting you is if you're running webmin on your own computer - is that the case?

[edited to be more specific/accurate]

share|improve this answer
So this does not affect port :10000 which is used for webmin? Cool. Any tools I can use to check what is causing the outtages? – Churchill Dec 12 '12 at 17:26
??? I read dpt:www so this rule should only affect the port which is listed as www in /etc/services... usually port 80. – Andy Friese Dec 12 '12 at 17:41
I am connecting to the server remotely from my desktop machine. – Churchill Dec 12 '12 at 18:16
@Andy Friese, you're right, I missed that bit. If webmin is running on port 10000 though, this rule really wouldn't apply. – ImaginaryRobots Dec 12 '12 at 19:13
Yeah, that's strange. Just a very wild guess: images might get loaded over 80 as they don't contain sensitive information. 10000 is for sensitive stuff via SSL... Anyway, the OP seems to has resolved his issue so I don't care :) – Andy Friese Dec 12 '12 at 19:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.