Hi, I've a very simple rule set as follows, and in summary it looks to me like udp connection tracking info is only being updated for traffic comming into the box?
Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT all -- 127.0.0.1 anywhere
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT all -- 172.18.1.170 anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere state NEW,RELATED,ESTABLISHED
The problem is that I can't initiate udp from this box. If I allow udp in, I can do tftp fine. Then removing the udp rule I can tftp fine for variable amount of time 0s, 30s, 180s.
I'm using linux 2.4.20 and iptables v1.2.7a
Ah hang on, when the UDP is sent out, the following
is added to /proc/net/ip_conntrack as expected:
udp 17 22 src=172.18.1.55 dst=172.18.1.14 sport=32769 dport=69 [UNREPLIED] src=172.18.1.14 dst=172.18.1.55 sport=69 dport=32769 use=1
However the response packet doesn't use 69 as the sport. It seems to use an ephemeral one (33118)
FYI the tftpd is "tftp-hpa 0.34, with remap, with tcpwrappers"
Hmm: http://www.zytor.com/pipermail/syslinux/2003-April/001851.html
Should udp connection tracking only use the sport for outgoind packets and dport for incomming packets?
Pádraig.
