Re: UDP connection tracking problem

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



P@xxxxxxxxxxxxxx wrote:
Hi, I've a very simple rule set as follows, and in summary
it looks to me like udp connection tracking info
is only being updated for traffic comming into the box?

Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT all -- 127.0.0.1 anywhere
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT all -- 172.18.1.170 anywhere


Chain OUTPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere state NEW,RELATED,ESTABLISHED


The problem is that I can't initiate udp from this box.
If I allow udp in, I can do tftp fine.
Then removing the udp rule I can tftp fine for
variable amount of time 0s, 30s, 180s.

I'm using linux 2.4.20 and iptables v1.2.7a

Ah hang on, when the UDP is sent out, the following
is added to /proc/net/ip_conntrack as expected:
udp 17 22 src=172.18.1.55 dst=172.18.1.14 sport=32769 dport=69 [UNREPLIED] src=172.18.1.14 dst=172.18.1.55 sport=69 dport=32769 use=1


However the response packet doesn't use 69 as the sport.
It seems to use an ephemeral one (33118) :-(

FYI the tftpd is "tftp-hpa 0.34, with remap, with tcpwrappers"

Hmm: http://www.zytor.com/pipermail/syslinux/2003-April/001851.html

Pádraig.




[Index of Archives]     [Linux Netfilter Development]     [Linux Kernel Networking Development]     [Netem]     [Berkeley Packet Filter]     [Linux Kernel Development]     [Advanced Routing & Traffice Control]     [Bugtraq]

  Powered by Linux