Re: a sort of n00b question here but I'ld like to know.

Jeffrey Laramie <JALaramie@xxxxxxxxxxxxxxxxxxx> · Mon, 20 Oct 2003 22:34:09 -0400

SBlaze wrote:

  You be the judge. I start my firewall when the box boots up. Pay special
attention to the UDP rule. Note that in the 11 day up time we have 16 Million
droppped UDP NEW/Invalid packets. Is this enough to choke down a Dual Pentium
Pro 200mhz box?

root@nixn00b:/proc/net# uptime ; iptables -vnL
 21:56:57 up 11 days, 21:21,  4 users,  load average: 0.00, 0.00, 0.00
Chain INPUT (policy ACCEPT 1008K packets, 736M bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DROP       all  --  *      *       68.119.x.x          0.0.0.0/0
    0     0 DROP       all  --  *      *       68.119.x.x       0.0.0.0/0
    0     0 DROP       all  --  *      *       68.119.x.x         0.0.0.0/0
85058 5514K ACCEPT     all  --  eth0   *       68.1.x.x         0.0.0.0/0
 4676  432K ACCEPT     all  --  eth0   *       68.63.x.x        0.0.0.0/0
 9656  639K ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0  
       tcp dpt:80
 309K   20M ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0  
       udp dpt:27015 state NEW,RELATED,ESTABLISHED
 3262  191K DROP       tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0  
       state INVALID,NEW
 288K  427M ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0  
       state RELATED,ESTABLISHED
  16M 1945M DROP       udp  --  eth0   *       0.0.0.0/0            0.0.0.0/0  
       state INVALID,NEW
 6815 1166K ACCEPT     udp  --  eth0   *       0.0.0.0/0            0.0.0.0/0  
       state RELATED,ESTABLISHED
 2767  249K DROP       icmp --  eth0   *       0.0.0.0/0            0.0.0.0/0  
       state INVALID,NEW
  339 24646 ACCEPT     icmp --  eth0   *       0.0.0.0/0            0.0.0.0/0  
       state RELATED,ESTABLISHED

Some quick math show that roughly 80% of your total traffic is trapped
by that rule. Ouch! Also, do you really want your default policy to be
accept? It looks like you had 736 Mbytes go to some other (unknown?)
destination on your firewall box.

Jeff 