Reconfiguração firewall

[SOMBRIO]

 :)Boa Tarde!

Senhores, presciso de uma luz na configuração do firewall do servidor samba de minha empresa. Funcionava perfeitamente enquanto INPUT em ACCEPT. Resolvi estabelecer regras mais rigorosas no script mudando o INPUT para DROP e autorizando somente o ip da máquina aliado ao mac por conta de alguns endereços estranhos que começaram a aparecer na tabela arp. Não mudei mais nada. O resultado foi perfeito, porém quando chamo um arp -a, ou um iptables -L no terminal do servidor ou por ssh as respostas ficaram muito lentas. Exemplo o iptables -L mostra uma regra atribuida a cada 20 segundos, o arp -a uma resposta a cada 20 segundos. Não consegui entender o motivo.  O servidor é um quadcore, 4 gb de ram, 3 placas de rede gigabite atendendo 75 máquinas somente como servidor de arquivos. Uma das placas de rede uso com ip fixo em link corporativo para acesso ssh. O funcionamento geral está um maravilha, agora no terminal da sono. Agradeço de antemão. Abaixo script do firewal.

Obrigado.


iniciar(){

iptables -P INPUT DROP

#SSH
iptables -A INPUT -i eth0 -p tcp --dport 3333 -j ACCEPT

#LOOPBACK
iptables -A INPUT -i lo -j ACCEPT

#NTOP
iptables -A INPUT -p tcp --dport 3000 -j ACCEPT


#######################################################################
#MAC'S IP'S LIBERADOS
#########################################################################################################


# Setor principal
iptables -A INPUT -s 10.0.30.2 -m mac --mac-source 00:00:00:00:00:00 -j ACCEPT
iptables -A INPUT -s 10.0.30.3 -m mac --mac-source 00:00:00:00:00:00 -j ACCEPT
iptables -A INPUT -s 10.0.30.4 -m mac --mac-source 00:00:00:00:00:00 -j ACCEPT
iptables -A INPUT -s 10.0.30.6 -m mac --mac-source 00:00:00:00:00:00 -j ACCEPT
iptables -A INPUT -s 10.0.30.7 -m mac --mac-source 00:00:00:00:00:00 -j ACCEPT
iptables -A INPUT -s 10.0.30.9 -m mac --mac-source 00:00:00:00:00:00 -j ACCEPT
iptables -A INPUT -s 10.0.30.11 -m mac --mac-source 00:00:00:00:00:00 -j ACCEPT
iptables -A INPUT -s 10.0.30.18 -m mac --mac-source 00:00:00:00:00:00 -j ACCEPT
iptables -A INPUT -s 10.0.30.19 -m mac --mac-source 00:00:00:00:00:00 -j ACCEPT
iptables -A INPUT -s 10.0.30.21 -m mac --mac-source 00:00:00:00:00:00 -j ACCEPT ............................
.............................etc

# setor 1
iptables -A INPUT -s 10.67.23.2 -m mac --mac-source 00:00:00:00:00:00 -j ACCEPT
iptables -A INPUT -s 10.67.23.3 -m mac --mac-source 00:00:00:00:00:00 -j ACCEPT
iptables -A INPUT -s 10.67.23.4 -m mac --mac-source 00:00:00:00:00:00 -j ACCEPT
iptables -A INPUT -s 10.67.23.5 -m mac --mac-source 00:00:00:00:00:00 -j ACCEPT
iptables -A INPUT -s 10.67.23.6 -m mac --mac-source 00:00:00:00:00:00 -j ACCEPT
iptables -A INPUT -s 10.67.23.7 -m mac --mac-source 00:00:00:00:00:00 -j ACCEPT
iptables -A INPUT -s 10.67.23.8 -m mac --mac-source 00:00:00:00:00:00 -j ACCEPT
iptables -A INPUT -s 10.67.23.9 -m mac --mac-source 00:00:00:00:00:00 -j ACCEPT
iptables -A INPUT -s 10.67.23.10 -m mac --mac-source 00:00:00:00:00:00 -j ACCEPT
iptables -A INPUT -s 10.67.23.11 -m mac --mac-source 00:00:00:00:00:00 -j ACCEPT
iptables -A INPUT -s 10.67.23.12 -m mac --mac-source 00:00:00:00:00:00 -j ACCEPT
iptables -A INPUT -s 10.67.23.13 -m mac --mac-source 00:00:00:00:00:00 -j ACCEPT
iptables -A INPUT -s 10.67.23.14 -m mac --mac-source 00:00:00:00:00:00 -j ACCEPT
iptables -A INPUT -s 10.67.23.15 -m mac --mac-source 00:00:00:00:00:00 -j ACCEPT
iptables -A INPUT -s 10.67.23.16 -m mac --mac-source 00:00:00:00:00:00 -j ACCEPT...........................
.............................................etc



############################################################################


#OUTRAS PROTEÇÕES
iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1400:1536 -j TCPMSS --clamp-mss-to-pmtu
iptables -A INPUT -m state --state INVALID -j DROP
iptables -A INPUT -p icmp --icmp-type echo-request -j DROP
echo 1 > /proc/sys/net/ipv4/conf/default/rp_filter


echo "---------------------Firewall ativo-----------------------"

}

parar(){
iptables -F

echo "Regras de firewall desativados"
}

case "$1" in
"start") iniciar;;
"stop") parar;;
"restart") parar; iniciar;;
*) echo "Use os parametros start ou stop"
esac