Bug 80785 - /etc/init.d/iptables status hangs
/etc/init.d/iptables status hangs
Product: Red Hat Linux
Classification: Retired
Component: iptables (Show other bugs)
All Linux
medium Severity medium
: ---
: ---
Assigned To: Thomas Woerner
Ben Levenson
Depends On:
  Show dependency treegraph
Reported: 2002-12-31 05:04 EST by Greg Pyhl
Modified: 2007-04-18 12:49 EDT (History)
0 users

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2003-07-03 05:33:48 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Greg Pyhl 2002-12-31 05:04:17 EST
Description of problem:
When using unreachable FQDNs or dummy IP addresses (like in
/etc/sysconfig/iptables, /etc/init.d/iptables status command hangs every now and

Version-Release number of selected component (if applicable):

How reproducible:
Almost always.

Steps to Reproduce:
1.Add some rules with unreachable FQDNs or dummy IP addresses to
2./etc/init.d/iptables status
Actual results:
Command hangs for several minutes during execution.

Expected results:
Command should finish in seconds.

Additional info:
Fix: add -n switch to status) segment in the init script:

- iptables -t $table --list
+ iptables -t $table --list -n

This does not hang with dummy IP addresses or unreachable FQDNs.
Comment 1 Michael Schwendt 2003-01-14 05:35:05 EST
Your problem is related to DNS and a terribly slow or unreachable nameserver.

"iptables --list" does DNS lookups. "iptables --list --numeric" does not.
iptables does not hang. It just has problems reaching your nameserver, resulting
in either noticable delays or DNS lookup time-outs.
Comment 2 Greg Pyhl 2003-01-16 02:51:39 EST
Yes, the iptables command itself does not hang, but when saying

/etc/init.d/iptables status

a user will be frustrated when s/he has to wait several minutes. It does not
matter is it because of DNS/iptables/whatever. These delays could easily be
avoided with -n.
Comment 3 Thomas Woerner 2003-07-03 05:33:48 EDT
Fixed in the new 1.2.8-4.x version. This version has a new startup script and an
additional config file.

> # Additional iptables modules (nat helper)
> # Default: -empty-
> #IPTABLES_MODULES="ip_nat_ftp"
> # Save current firewall rules on stop.
> # Value: yes|no,  default: no
> # Save current firewall rules on restart.
> # Value: yes|no,  default: no
> # Save rule counter.
> # Value: yes|no,  default: yes
> # Numeric status output
> # Value: yes|no,  default: no

RPM packages for 7.x:

RPM packages for 8.0:

RPM packages for 9:

Note You need to log in before you can comment on or make changes to this bug.