On Thu, Mar 29, 2018 at 12:48 PM, Asif Iqbal <vadud3@xxxxxxxxx> wrote:
>
>
> On Thu, Mar 29, 2018 at 7:21 AM, Steven Tardy <sjt5atra@xxxxxxxxx> wrote:
>
>> A STATEFUL firewall with “ip any any” can and will still block asymmetric
>> communications due to the firewall keeping track of state (hence tha name
>> stateful firewall).
>>
>> Tcpdump on your servers /other/ NICs and you’ll see the tftp traffic
>> leaving your server on some other NIC (probably on with the default
>> route).
>>
>
> A (192.168.1.10)
> S (192.168.1.20)
>
> I do not see tftp traffic is leaving from S
>
> A:~$ tftp
> (to) 192.168.1.20
> tftp> get file
> Transfer timed out.
>
> As you can see no pkt is leaving. If it were leaving S, but A were not
> receiving then I would think firewall
> is dropping it.
>
> [ S ~]$ sudo tcpdump -A -nniany host 192.168.1.10
> tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
> listening on any, link-type LINUX_SLL (Linux cooked), capture size 262144
> bytes
>
> 16:40:08.390939 IP 192.168.1.10.35553 > 192.168.1.20.69: 16 RRQ "file"
> netascii
> E..,J1@.>..n./...oAt...E..#...file.netascii...................
> 16:40:13.391133 IP 192.168.1.10.35553 > 192.168.1.20.69: 16 RRQ "file"
> netascii
> E..,N.@.>..../...oAt...E..#...file.netascii...................
> 16:40:18.391220 IP 192.168.1.10.35553 > 192.168.1.20.69: 16 RRQ "file"
> netascii
> E..,QK@.>..T./...oAt...E..#...file.netascii...................
> 16:40:23.391373 IP 192.168.1.10.35553 > 192.168.1.20.69: 16 RRQ "file"
> netascii
> E..,T^@.>..@./...oAt...E..#...file.netascii...................
> 16:40:28.391469 IP 192.168.1.10.35553 > 192.168.1.20.69: 16 RRQ "file"
> netascii
> E..,X.@.>..../...oAt...E..#...file.netascii...................
>
>
>
I still like some help on this
>
>
>>
>> The upstream firewall will then block the tftp response if it never saw
>> the
>> tftp request (due to asymmetry).
>> _______________________________________________
>> CentOS mailing list
>> CentOS@xxxxxxxxxx
>> https://lists.centos.org/mailman/listinfo/centos
>>
>
>
>
>
--
Asif Iqbal
PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
_______________________________________________
CentOS mailing list
CentOS@xxxxxxxxxx
https://lists.centos.org/mailman/listinfo/centos
