I have a centos 6.5 64bit router with 3 nics. The box is configured to route 2 networks. netA - eth1 [ about 10 clients ] netB - eth2 [ about 100 clients ] provider - eth0 [ fiber to isp ]

I have a custom script that initializes the firewall and also sets marks in mangle table for qos purposes. The script initializes by flushing all rules in all tables. The -F -X drill for filter nat mangle and then it begins to compose the rules. I also have the nf_conntrack module loaded and my script does not unload it. Note that I don't use the official rhel firewall scripts.

Everything works until I run the script for various reasons (modify certain qos requirements, filter certain users, ports etc whathaveyou). At that time my ssh connection to the box freezes and i can't even ping it. Of course there's no internet connectivity and my lan is frozen. Funny thing the netA computers are only cut off for a few seconds but the netB lan looses connectivity for about a minute or two. Then everything is back to normal.

Where do I start ?

  • I'd look at the sequence that the rules are loaded. If Net A's rules are all at the top, and there are a lot of them, and Net B's rules are all at the bottom, then the time needed to run through all of Net A's rules could be up to a minute before Net B's rules are run.
    – Lawrence
    Jan 20, 2014 at 15:54
  • What @Lawrence says is especially true if you change default policies at the top, and the def.pol are REJECT. In this case, under his assumptions, it will take A little time to regain connectivity, and a long time for B to do the same. Of course this is the right thing to do: if you add def.policies at then end, for some time someone will be able to circumvent iptables, and then the ESTABLISHED, RELATED rule will save these (dangerous) connections. Jan 20, 2014 at 16:09
  • The number of rules has a significant impact on performance when loading rules. Once your iptables is the way you want it iptables-save and iptables-restore should be all you ever need to save/reload iptables config. Modules and ipset sets, and etc could be scripted separately. We have no idea how fast the CPU or how much RAM it has so it could be hardware limitations.
    – cybernard
    Jan 20, 2014 at 17:13
  • iptables wise, It has default accept policy with a bottom DROP rule. Hardware wise it has a Intel(R) Xeon(TM) CPU 2.66GHz cpu with 2 cores and 1 gb ram.
    – Horatiu
    Jan 20, 2014 at 17:21
  • How many rules do you have? #1 0-50 #2 50-100 #3 100-200 #4 200-400 #5 400-500 #6 500+ insanity.
    – cybernard
    Jan 20, 2014 at 19:29


You must log in to answer this question.

Browse other questions tagged .