speed connection problem

DISCUSSION stephane durieux 4 participants 4 messages Jul 26, 2004 – Jul 27, 2004

Share & tools

stephane durieux

author

2004-07-26 14:47 UTC #0 lore raw

Hi everybody,

I am a newbie using netfilter
So I am connected to internet through ppp0 (ADSL)
I have no servers running. But, I have tried to make customs rules for each used protocols (smtp, pop3, dns, http, https, imap, ftp active and passive) in input and output. i have also to drop some Xmas packets and spoofing packets ( private netwoaks range) .
So i have 40 rules listed (see below)

I have seen a big decrease of my speed connection using the firewall. Nevertheless, the computer is an AMD athlon XP 1800+

How can I solve this problem. Is it due to my heavy configuration ? I am afraid it will be worse if I install DMZ servers (http, ftp, postfix, dns)

Have you got any suggestion ?

Thanks a lot.

Here is my (heavy) configuration

#!/bin/bash

case $1 in
start)

########################## REMISE A 0 DES CHAINES

iptables -F FORWARD
iptables -F OUTPUT
iptables -F INPUT
iptables -F syn-flood
iptables -X syn-flood

########################## FLUX ENTRANT

# ANTI SPOOFING
iptables -t filter -A INPUT -i ppp0 -p tcp -s 224.0.0.0/4 -j DROP iptables -t filter -A INPUT -i ppp0 -p tcp -s 192.168.0.0/16 -j DROP iptables -t filter -A INPUT -i ppp0 -p tcp -s 172.16.0.0/12 -j DROP iptables -t filter -A INPUT -i ppp0 -p tcp -s 10.0.0.0/8 -j DROP iptables -t filter -A INPUT -i ppp0 -p tcp -s 127.0.0.1/8 -j DROP

iptables -t filter -A INPUT -i ppp0 -p udp -s 224.0.0.0/4 -j DROP iptables -t filter -A INPUT -i ppp0 -p udp -s 192.168.0.0/16 -j DROP iptables -t filter -A INPUT -i ppp0 -p udp -s 172.16.0.0/12 -j DROP iptables -t filter -A INPUT -i ppp0 -p udp -s 10.0.0.0/8 -j DROP iptables -t filter -A INPUT -i ppp0 -p udp -s 127.0.0.1/8 -j DROP

# SYN FLOODING
iptables -N syn-flood
iptables -A INPUT -i ppp0 -p tcp -j syn-flood
iptables -A syn-flood -m limit --limit 1/s --limit-burst 4 -j RETURN iptables -A syn-flood -j LOG --log-prefix "SYN FLOOD" iptables -A syn-flood -j DROP

# VERIF NOUVELLES CONNECTIONS ENTRANTES =SYN
iptables -t filter -A INPUT -i ppp0 -p tcp ! --syn -m state --state NEW -j DROP

# ANTI Xmas packets
iptables -t filter -A INPUT -i ppp0 -p tcp --tcp-flags ALL ALL -j DROP iptables -t filter -A INPUT -i ppp0 -p tcp --tcp-flags ALL NONE -j DROP

# DNS
iptables -t filter -A INPUT -i ppp0 -p udp --source-port 53 -m state --state ESTABLISHED -j ACCEPT

# HTTP
iptables -t filter -A INPUT -i ppp0 -p tcp --source-port 80 -m state --state ESTABLISHED -j ACCEPT

# HTTPS
iptables -t filter -A INPUT -i ppp0 -p tcp --source-port 443 -m state --state ESTABLISHED -j ACCEPT

# ICMP

iptables -t filter -A INPUT -i ppp0 -p icmp --icmp-type echo-reply -j ACCEPT iptables -t filter -A INPUT -i ppp0 -p icmp --icmp-type destination-unreachable -j ACCEPT iptables -t filter -A INPUT -i ppp0 -p icmp --icmp-type time-exceeded -j ACCEPT iptables -t filter -A INPUT -i ppp0 -p icmp --icmp-type source-quench -j ACCEPT

# FTP

# port commande
iptables -t filter -A INPUT -i ppp0 -p tcp --source-port 21 --destination-port 1024: -m state --state ESTABLISHED -j ACCEPT
# mode actif : port data
iptables -t filter -A INPUT -i ppp0 -p tcp --source-port 20: --destination-port 1024: -m state --state RELATED,ESTABLISHED -j ACCEPT
# mode passif : port data
iptables -t filter -A INPUT -i ppp0 -p tcp --source-port 1024: --destination-port 1024: -m state --state ESTABLISHED -j ACCEPT

# SMTP
iptables -t filter -A OUTPUT -o ppp0 -p tcp --source-port 1024: --destination-port 25 -m state --state NEW,ESTABLISHED -j ACCEPT

# POP 3
iptables -t filter -A OUTPUT -o ppp0 -p tcp --source-port 1024: --destination-port 110 -m state --state NEW,ESTABLISHED -j ACCEPT

# IMAP
iptables -t filter -A OUTPUT -o ppp0 -p tcp --source-port 1024: --destination-port 143 -m state --state NEW,ESTABLISHED -j ACCEPT

iptables -t filter -A INPUT -j DROP

########################## FLUX SORTANT

# DNS
iptables -t filter -A OUTPUT -o ppp0 -p udp --source-port 1024: --destination-port 53 -m state --state NEW,ESTABLISHED -j ACCEPT

# HTTP
iptables -t filter -A OUTPUT -o ppp0 -p tcp --source-port 1024: --destination-port 80 -m state --state NEW,ESTABLISHED -j ACCEPT

# HTTPS
iptables -t filter -A OUTPUT -o ppp0 -p tcp --source-port 1024: --destination-port 443 -m state --state NEW,ESTABLISHED -j ACCEPT

# ICMP

iptables -t filter -A OUTPUT -o ppp0 -p icmp --icmp-type echo-request -j ACCEPT

# FTP

# port commande
iptables -t filter -A OUTPUT -o ppp0 -p tcp --source-port 1024: --destination-port 21 -j ACCEPT
# mode actif : port data
iptables -t filter -A OUTPUT -o ppp0 -p tcp --source-port 1024: --destination-port 20 -m state --state ESTABLISHED -j ACCEPT
# mode passif : port data
iptables -t filter -A OUTPUT -o ppp0 -p tcp --source-port 1024: --destination-port 1024: -m state --state RELATED,ESTABLISHED  -j ACCEPT

# SMTP
iptables -t filter -A OUTPUT -o ppp0 -p tcp --source-port 1024: --destination-port 25 -m state --state NEW,ESTABLISHED -j ACCEPT

# POP 3
iptables -t filter -A OUTPUT -o ppp0 -p tcp --source-port 1024: --destination-port 110 -m state --state NEW,ESTABLISHED -j ACCEPT

# IMAP
iptables -t filter -A OUTPUT -o ppp0 -p tcp --source-port 1024: --destination-port 143 -m state --state NEW,ESTABLISHED -j ACCEPT

iptables -t filter -A OUTPUT -j DROP

iptables -t filter -F INPUT

Brent Clark

2004-07-26 13:06 UTC #1 lore raw

Im also new to iptables and I think you are confusing the input and output rules with the forward rule (I very much made that mistake). In your FW rulset you are declaring that you have a imap, ftp, dns, etc literally running on your box.
You need to use the forward rule to handle this for you.
I too have a adsl connection, and I dont have any performance loss and the box I run iptables on is an
old pentium 100.

I have attached my current ruleset for your viewing. Please remember that im also new to iptables soo it might not be
all that secure.

Kind Regards
Brent Clark

P.s. You may want to look at the default policy of DROP on all the chains

-----Original Message-----
From: [email protected] [mailto:[email protected]]On Behalf Of stephane durieux
Sent: Monday, July 26, 2004 4:48 PM
To: [email protected]
Subject: speed connection problem

Hi everybody,

I am a newbie using netfilter
So I am connected to internet through ppp0 (ADSL)
I have no servers running. But, I have tried to make customs rules for each used protocols (smtp, pop3, dns, http, https, imap, ftp active and passive) in input and output.
i have also to drop some Xmas packets and spoofing packets ( private netwoaks range) .
So i have 40 rules listed (see below)

I have seen a big decrease of my speed connection using the firewall. Nevertheless, the computer is an AMD athlon XP 1800+

How can I solve this problem. Is it due to my heavy configuration ? I am afraid it will be worse if I install DMZ servers (http, ftp, postfix, dns)

Have you got any suggestion ?

Thanks a lot.

Here is my (heavy) configuration

#!/bin/bash

case $1 in
start)

########################## REMISE A 0 DES CHAINES

iptables -F FORWARD
iptables -F OUTPUT
iptables -F INPUT
iptables -F syn-flood
iptables -X syn-flood

########################## FLUX ENTRANT

# VERIF NOUVELLES CONNECTIONS ENTRANTES =SYN
iptables -t filter -A INPUT -i ppp0 -p tcp ! --syn -m state --state NEW -j DROP

# ANTI Xmas packets
iptables -t filter -A INPUT -i ppp0 -p tcp --tcp-flags ALL ALL -j DROP iptables -t filter -A INPUT -i ppp0 -p tcp --tcp-flags ALL NONE -j DROP

# DNS
iptables -t filter -A INPUT -i ppp0 -p udp --source-port 53 -m state --state ESTABLISHED -j ACCEPT

# HTTP
iptables -t filter -A INPUT -i ppp0 -p tcp --source-port 80 -m state --state ESTABLISHED -j ACCEPT

# HTTPS
iptables -t filter -A INPUT -i ppp0 -p tcp --source-port 443 -m state --state ESTABLISHED -j ACCEPT

# ICMP

iptables -t filter -A INPUT -i ppp0 -p icmp --icmp-type echo-reply -j ACCEPT iptables -t filter -A INPUT -i ppp0 -p icmp --icmp-type destination-unreachable -j ACCEPT
iptables -t filter -A INPUT -i ppp0 -p icmp --icmp-type time-exceeded -j ACCEPT
iptables -t filter -A INPUT -i ppp0 -p icmp --icmp-type source-quench -j ACCEPT

# FTP

# port commande
iptables -t filter -A INPUT -i ppp0 -p tcp --source-port 21
--destination-port 1024: -m state --state ESTABLISHED -j ACCEPT
# mode actif : port data
iptables -t filter -A INPUT -i ppp0 -p tcp --source-port 20:
--destination-port 1024: -m state --state RELATED,ESTABLISHED -j ACCEPT
# mode passif : port data
iptables -t filter -A INPUT -i ppp0 -p tcp --source-port 1024:
--destination-port 1024: -m state --state ESTABLISHED -j ACCEPT

# SMTP
iptables -t filter -A OUTPUT -o ppp0 -p tcp --source-port 1024:
--destination-port 25 -m state --state NEW,ESTABLISHED -j ACCEPT

# POP 3
iptables -t filter -A OUTPUT -o ppp0 -p tcp --source-port 1024:
--destination-port 110 -m state --state NEW,ESTABLISHED -j ACCEPT

# IMAP
iptables -t filter -A OUTPUT -o ppp0 -p tcp --source-port 1024:
--destination-port 143 -m state --state NEW,ESTABLISHED -j ACCEPT

iptables -t filter -A INPUT -j DROP

########################## FLUX SORTANT

# DNS
iptables -t filter -A OUTPUT -o ppp0 -p udp --source-port 1024:
--destination-port 53 -m state --state NEW,ESTABLISHED -j ACCEPT

# HTTP
iptables -t filter -A OUTPUT -o ppp0 -p tcp --source-port 1024:
--destination-port 80 -m state --state NEW,ESTABLISHED -j ACCEPT

# HTTPS
iptables -t filter -A OUTPUT -o ppp0 -p tcp --source-port 1024:
--destination-port 443 -m state --state NEW,ESTABLISHED -j ACCEPT

# ICMP

iptables -t filter -A OUTPUT -o ppp0 -p icmp --icmp-type echo-request -j ACCEPT

# FTP

# port commande
iptables -t filter -A OUTPUT -o ppp0 -p tcp --source-port 1024:
--destination-port 21 -j ACCEPT
# mode actif : port data
iptables -t filter -A OUTPUT -o ppp0 -p tcp --source-port 1024:
--destination-port 20 -m state --state ESTABLISHED -j ACCEPT
# mode passif : port data
iptables -t filter -A OUTPUT -o ppp0 -p tcp --source-port 1024:
--destination-port 1024: -m state --state RELATED,ESTABLISHED  -j ACCEPT

# SMTP
iptables -t filter -A OUTPUT -o ppp0 -p tcp --source-port 1024:
--destination-port 25 -m state --state NEW,ESTABLISHED -j ACCEPT

# POP 3
iptables -t filter -A OUTPUT -o ppp0 -p tcp --source-port 1024:
--destination-port 110 -m state --state NEW,ESTABLISHED -j ACCEPT

# IMAP
iptables -t filter -A OUTPUT -o ppp0 -p tcp --source-port 1024:
--destination-port 143 -m state --state NEW,ESTABLISHED -j ACCEPT

iptables -t filter -A OUTPUT -j DROP

iptables -t filter -F INPUT

Antony Stone

2004-07-26 13:27 UTC #2 lore raw

In reply to stephane durieux

Quoted 3 lines · stephane durieux

Hi everybody,
I am a newbie using netfilter

I recommend two things:

1. Start simple, and build up the rules gradually.

2. Read Oskar Andreasson's tutorial at http://iptables-tutorial.frozentux.net

Regards,

Antony.

Signature · 4 lines

Wanted: telepath.   You know where to apply.

                                                     Please reply to the list;
                                                           please don't CC me.

Mark E. Donaldson

2004-07-27 04:41 UTC #3 lore raw

In reply to stephane durieux

How can I solve this problem. Is it due to my heavy configuration ? I am afraid it will be worse if I install DMZ servers (http, ftp, postfix, dns)

Have you got any suggestion ?

Thanks a lot.

Here is my (heavy) configuration

This is not what I would call a heavy load Stephane. Your rig should handle this without a blink. My netfilter/iptables firewall is also directly connected to the internet via dsl (albeit with a static IP), with five subnets behind it, including a DMZ with a mail relay, DNS server, web server, squid proxy, etc, etc, blah, blah. My rule set stands at approximately 2000 and my machine does not blink. So I suggest the slow down might be something else. Suggestions and questions:

1. Run your firewall (temporarily of course) with no rules loaded and all your default policies set to default so you can make some rate comparisons:

set_default_policy()

{
	$IPT -F

$IPT -X
$IPT -P INPUT ACCEPT
$IPT -P FORWARD ACCEPT
$IPT -P OUTPUT ACCEPT
}

2. Your FTP rules need a little tuning. I can see these giving you some problems with your ftp communication. Are you using ip_conntrack_ftp?

3. I notice you seem to favor source port 1024 on you output rules. I find this a little hard to understand. Is there a reason for this?