On Fri, 10 Jan 2014, Simon Hobson wrote: >> And I can't understand what is slowing DNS activity (connections by naame >> are slow while connections by IP are normal). > > Look at your name resolver setup. Slow DNS resolution is more likely to > be an issue with DNS than with the firewall - ie randomly blocking stuff > isn't likely to help. > > So first off, what is doing DNS resolution for you/your devices ? > Is the issue consistent ?
Thanks for your hints. Some investigations solved (partially), the "problem". The client in DMZ is a standard CentOS 5.x server configured as web server. In resolv.conf I have: ------------------------------------------- nameserver 127.0.0.1 nameserver 8.8.8.8 nameserver 208.67.222.222 ------------------------------------------- After reading your replay, I considered that I have a local resolver ... If I disable it: ------------------------------------------- #nameserver 127.0.0.1 nameserver 8.8.8.8 nameserver 208.67.222.222 ------------------------------------------- I had no more slow DNS resolution. That is Ok, but ... my shorewall's rules are: > DNS(ACCEPT) dmz:192.168.110.0/24 all > DROP dmz:192.168.110.0/24 net:!8.8.8.8,208.67.222.222 udp > > Where 8.8.8.8 and 208.67.222.222 are the DNS in /etc/resolv.conf As you say, I can just use: DNS(ACCEPT) dmz:192.168.110.0/24 all DROP dmz:192.168.110.0/24 net udp But this results in no DNS resolution at all. The local resolver first try to contact servers different from the "whitelisted" 8.8.8.8,208.67.222.222 and this generate the delay. But the DNS(ACCEPT) row seems not work at all. Nor replacing it with an explicit: ACCEPT dmz:192.168.110.0/24 all udp 53 What is wrong? Where is my mistake? Thanks, P. P.S.: I suppose it isn't important, but shorewall 4.4.11.6 in Debian 6.0.8 ------------------------------------------------------------------------------ CenturyLink Cloud: The Leader in Enterprise Cloud Services. Learn Why More Businesses Are Choosing CenturyLink Cloud For Critical Workloads, Development Environments & Everything In Between. Get a Quote or Start a Free Trial Today. http://pubads.g.doubleclick.net/gampad/clk?id=119420431&iu=/4140/ostg.clktrk _______________________________________________ Shorewall-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/shorewall-users
