I think you may need a FORWARD rule for DNS requests - INPUT and OUTPUT
rules only affect locally generated traffic.

 

  _____  

From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Ben
Sent: Tuesday, November 04, 2003 3:27 PM
To: netfilter@lists.netfilter.org

 

Hello,

 

I'm new to this list, so forgive me is I seem newbish :-)

 

The problem I am having that when I turn on iptables, I see rDNS lag to
about 30 seconds.  I see this happen with two programs I am using, proftpd
and uwimap.  Both work fine with flush tables, but when I run the following

 

IPTABLES="/sbin/iptables"

 

#Flush everything, start from scratch

$IPTABLES -F

 

#Set default policies to DROP

$IPTABLES -P INPUT DROP

$IPTABLES -P FORWARD DROP

 

#Set default OUTPUT policy to ACCEPT

$IPTABLES -P OUTPUT ACCEPT

 

# Open ports for server/services

$IPTABLES -A INPUT -p tcp --dport 20 -j ACCEPT 

$IPTABLES -A INPUT -p tcp --dport 21 -j ACCEPT 

$IPTABLES -A INPUT -p tcp --dport 22 -j ACCEPT 

$IPTABLES -A INPUT -p tcp --dport 25 -j ACCEPT 

$IPTABLES -A INPUT -p tcp --dport 37 -j ACCEPT 

$IPTABLES -A INPUT -p tcp --dport 43 -j ACCEPT 

$IPTABLES -A INPUT -p tcp --dport 53 -j ACCEPT 

$IPTABLES -A INPUT -p udp --dport 53 -j ACCEPT 

$IPTABLES -A INPUT -p tcp --dport 80 -j ACCEPT 

$IPTABLES -A INPUT -p tcp --dport 110 -j ACCEPT 

$IPTABLES -A INPUT -p tcp --dport 113 -j ACCEPT 

$IPTABLES -A INPUT -p tcp --dport 143 -j ACCEPT 

$IPTABLES -A INPUT -p tcp --dport 443 -j ACCEPT 

$IPTABLES -A INPUT -p tcp --dport 465 -j ACCEPT 

$IPTABLES -A INPUT -p udp --dport 465 -j ACCEPT 

$IPTABLES -A INPUT -p tcp --dport 873 -j ACCEPT 

$IPTABLES -A INPUT -p udp --dport 873 -j ACCEPT 

$IPTABLES -A INPUT -p tcp --dport 993 -j ACCEPT 

$IPTABLES -A INPUT -p tcp --dport 995 -j ACCEPT 

$IPTABLES -A INPUT -p tcp --dport 2082 -j ACCEPT 

$IPTABLES -A INPUT -p tcp --dport 2083 -j ACCEPT 

$IPTABLES -A INPUT -p tcp --dport 2086 -j ACCEPT 

$IPTABLES -A INPUT -p tcp --dport 2087 -j ACCEPT 

$IPTABLES -A INPUT -p tcp --dport 2089 -j ACCEPT

 

I see login request spike from almost instant to upwards of 30 seconds.
This of course causes timeouts with most client software.

 

Has anyone run into this before? Does anyone know how I might go about
fixing it?