2

I am trying to build some basic iptables rules for my VDS:

iptables -A INPUT -p tcp --dport ssh -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -P INPUT DROP

I want to block any incoming traffic except for traffic SSH and WEB. But after applying the rules and rebooting the system, it takes 30 seconds to login via SSH, the login process is very slow, but it works perfectly after I connect.

What rules should I add to make loggining in via SSH faster?

2

From iptables --help:

--numeric   -n      numeric output of addresses and ports

https://serverfault.com/questions/85602/iptables-l-pretty-slow-is-this-normal

Include the -n option so it doesn't try to use DNS to resolve names for every IP address, network and port. Then it will be fast.

https://help.ubuntu.com/community/IptablesHowTo

Allowing Established Sessions

We can allow established sessions to receive traffic:

sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

If the line above doesn't work, you may be on a castrated VPS whose provider has not made available the extension, in which case an inferior version can be used as last resort:

sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

edited out because help.ubuntu.com offers a better and completer sollution ignore below

https://serverfault.com/questions/416537/why-does-a-valid-set-of-iptables-rules-slow-my-server-to-a-crawl

Rule to accept traffic based on existing traffic

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
  • Tried to add the last one iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT and get an error No chain/target/match by that name – Mr. twister May 19 '16 at 17:18
  • And could you tell me where should I put --numeric -n numeric output of addresses and ports – Mr. twister May 19 '16 at 17:18
  • @Mr.twister: The --numeric -n thing is for when listing stuff with iptables, nothing to do with your problem, at least as I understand it. You need the iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT rule. You should also have a iptables -A INPUT -i lo -j ACCEPT rule. However, I can not recreate your issue on one of my test servers. What version of Ubuntu are you using? – Doug Smythies May 19 '16 at 21:48
  • I use Ubuntu 14.04.4 LTS, and this one does not work as well iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT — I get the same error. – Mr. twister May 19 '16 at 23:57
  • try starting over and following iptablesHowTo. also the order of the rules matter, if you accept something then deny the rest and then try to add a rule that allows again strange things happen. you need to add rules in a specific order and ending with a drop(i believe). – Frank Schrijver May 20 '16 at 12:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.