The UNIX and Linux Forums  

Go Back   The UNIX and Linux Forums > OS Specific Forums > BSD
ipfw slow ssh and ftp connections ipfw slow ssh and ftp connections
Google UNIX.COM
Forums Portal Register Rules & FAQ Members List Arcade Search Today's Posts Mark Forums Read


BSD BSD, sometimes called Berkeley Unix, is a Unix operating system developed by the Computer Systems Research Group of the UC Berkeley.

More UNIX and Linux Forum Topics You Might Find Helpful
Thread Thread Starter Forum Replies Last Post
Need help with IPFW.. Please... fundidor UNIX for Dummies Questions & Answers 2 10-10-2005 04:23 PM
FreeBSD IPFW Rules clarification please... DanUK Security 0 04-28-2005 10:51 AM
HP-UX: X connections...? abhayh HP-UX 0 04-25-2005 02:22 AM
ipfw directives and order of precidence... [MA]Flying_Meat Security 0 03-11-2004 08:39 PM
fBSD nat ipfw hachik UNIX for Dummies Questions & Answers 3 06-07-2002 12:20 PM

Reply
 
Submit Tools LinkBack Thread Tools Display Modes
  #1 (permalink)  
Old 05-06-2005
Registered User
  

Join Date: May 2005
Posts: 8
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit! Stumble this Post!Spurl this Post!
ipfw slow ssh and ftp connections
just as the title says.
thanks.

#General Rule Sets
/sbin/ipfw add 0300 check-state
/sbin/ipfw add 0301 deny tcp from any to any in established
/sbin/ipfw add 0302 pass tcp from any to any out setup keep-state
/sbin/ipfw add 0303 pass udp from any to any out

#SSH FTP
/sbin/ipfw add 0400 pass tcp from any to any 22 in setup keep-state
/sbin/ipfw add 0401 pass tcp from any to any 21 in setup keep-state

#HTTP HTTPS
/sbin/ipfw add 0500 pass tcp from any to any 80 in setup keep-state
/sbin/ipfw add 0501 pass tcp from any to any 443 in setup keep-state

#IMAP IMAPS POP3 SMTP
/sbin/ipfw add 0600 pass udp from any to any 25 in
/sbin/ipfw add 0601 pass tcp from any to any 25 in setup keep-state
/sbin/ipfw add 0602 pass tcp from any to any 143 in setup keep-state
/sbin/ipfw add 0603 pass udp from any to any 143 in
/sbin/ipfw add 0604 pass tcp from any to any 993 in setup keep-state
/sbin/ipfw add 0605 pass tcp from any to any 110 in setup keep-state
/sbin/ipfw add 0606 pass udp from any to any 110 in

#DNS
/sbin/ipfw add 0700 pass udp from any to any 53 in
/sbin/ipfw add 0701 pass tcp from any to any 53 in setup keep-state
/sbin/ipfw add 0702 pass udp from xxx.xxx.xxx.xxx to any in
/sbin/ipfw add 0703 pass udp from xxx.xxx.xxx.xxx to any in
Reply With Quote
Forum Sponsor
  #2 (permalink)  
Old 05-12-2005
Registered User
  

Join Date: May 2005
Posts: 8
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit! Stumble this Post!Spurl this Post!
no ideas anyone ? dns is not an issue, when connecting with the IP of this box logging in is still slow.
Reply With Quote
  #3 (permalink)  
Old 05-12-2005
Perderabo's Avatar
Unix Daemon
  

Join Date: Aug 2001
Location: Washington DC Area
Posts: 8,253
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit! Stumble this Post!Spurl this Post!
After you connect to the box, from that box, do a reverse dns lookup on the ip address that you originate from. Is that is slow, then this is a dns issue.
Reply With Quote
  #4 (permalink)  
Old 05-12-2005
Registered User
  

Join Date: May 2005
Posts: 8
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit! Stumble this Post!Spurl this Post!
the reverse lookup took about 8-9 seconds.
Reply With Quote
  #5 (permalink)  
Old 05-12-2005
Perderabo's Avatar
Unix Daemon
  

Join Date: Aug 2001
Location: Washington DC Area
Posts: 8,253
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit! Stumble this Post!Spurl this Post!
Well, how does that compare with the login delay? The box will do a reverse dns lookup to log the connection.
Reply With Quote
  #6 (permalink)  
Old 05-12-2005
Registered User
  

Join Date: May 2005
Posts: 8
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit! Stumble this Post!Spurl this Post!
about the same, so should i double check my reverse dns configuration on the ssh server ?
Reply With Quote
  #7 (permalink)  
Old 05-12-2005
Perderabo's Avatar
Unix Daemon
  

Join Date: Aug 2001
Location: Washington DC Area
Posts: 8,253
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit! Stumble this Post!Spurl this Post!
That is a little slow for dns, I would check out the dns setup to try and find out why. I guess...actually 8 or 9 seconds probably wouldn't be much motivation. You can do stuff like setting up a caching-only name server on the target box. Or even use a hosts file. You probably can also configure your ftp server and ssh server to log ip addresses only. There are lots of options now that you know where the delay is.
Reply With Quote
  #8 (permalink)  
Old 05-13-2005
Registered User
  

Join Date: Aug 2004
Posts: 232
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit! Stumble this Post!Spurl this Post!
Quote:
Originally Posted by Perderabo
You can do stuff like setting up a caching-only name server on the target box. .
I use DNSmasq on my FreeBSD box and on all my Slackware-Linux machines, its a simple DNS cache to setup.
It should be available in the ports collection.
Reply With Quote
  #9 (permalink)  
Old 05-17-2005
Registered User
  

Join Date: May 2005
Posts: 8
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit! Stumble this Post!Spurl this Post!
Question
What would be causing the slow reverse lookups? When this box wasn't running ipfw my ssh and ftp logins were quick. Also isn't my ISP responsible for my reverse dns?

Also, can I not configure BIND to do the caching ?
Last edited by dwildgoose; 05-17-2005 at 08:31 AM.
Reply With Quote
  #10 (permalink)  
Old 05-17-2005
Registered User
  

Join Date: May 2005
Posts: 8
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit! Stumble this Post!Spurl this Post!
this is what I have tried so far.

I started an ssh connection to my server at work.

then i did a reverse lookup back to the client from my server.

# host 23.44.55.66
66.55.44.23.IN-ADDR.ARPA domain name pointer s23-44-55-66.ab.hsia.telus.net

then i tried adding an entry into /etc/hosts

23.44.55.66 s23-44-55-66.ab.hsia.telus.net

still slow logins..

this server is running bind, and a reverse zone file is made, why am i getting a reverse lookup from my isp ?

also, from users i have talked to in #freebsdhelp on efnet, bind caches by default.
Last edited by dwildgoose; 05-17-2005 at 09:24 AM.
Reply With Quote
  #11 (permalink)  
Old 05-17-2005
Registered User
  

Join Date: May 2005
Posts: 8
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit! Stumble this Post!Spurl this Post!
to add further..
i added localhost to /etc/resolv.conf

nslookup even on www.google.ca dies...

# nslookup www.google.ca
*** Can't find server name for address 127.0.0.1: Timed out
*** Can't find server name for address 154.11.129.59: Timed out

something wrong, and im lost......

i still think its my firewall guys...
Reply With Quote
  #12 (permalink)  
Old 05-18-2005
Registered User
  

Join Date: May 2005
Posts: 8
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit! Stumble this Post!Spurl this Post!
thanks all! figured it out allowed connections from me to my loopback device
Reply With Quote
Google UNIX.COM
Reply

Tags
linux

« BSD mouse | X configuration »
Thread Tools
Display Modes
Linear Mode Linear Mode


The 50 most popular UNIX and Linux searches.
Google Search Cloud for The UNIX and Linux Forums
421 service not available, remote server has closed connection ^m automate ftp autosys awk trim bash eval bash for loop boot: cannot open kernel/sparcv9/unix command copy/move folder in unix curses.h cut command in unix daemon process find grep find mtime find null character in a unix file glance unix grep multiple lines grep or grep recursive gzip password hp-ux ifconfig inaddr_any inappropriate ioctl for device lynx javascript mailx attachment mget mtime ping port remove first character from string in k shell replace space by comma , perl script scp recursive segmentation fault(coredump) sftp script snoop unix stale nfs file handle syn_sent tar exclude tar extract to folder test: argument expected unix unix .profile unix forum unix forums unix internals unix interview questions unix mtime unix simulator unix.com vi substitute while loop within while loop shell script


All times are GMT -7. The time now is 02:33 AM.

The UNIX and Linux Forums RSS Feeds - Contact Us - The UNIX and Linux Forums - Archive - Top

Powered by: vBulletin, Copyright ©2000 - 2006, Jelsoft Enterprises Limited.
The UNIX and Linux Forums Content Copyright ©1993-2008 The CEP Blog All Rights Reserved -Ad Management by RedTyger Visit The Global Fact Book

Content Relevant URLs by vBSEO 3.2.0

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101