Thanks!
I forgot to mention, though, that my source port for the SNMP informs is
also random, so I can't match against the destination port for the incoming
packet - does the recent target also maintain a port list or is it IP
addresses only?
From: Martijn Lievaart <m@xxxxxxx>
To: noa levy <noalevy@xxxxxxxxxxx>
CC: netfilter@xxxxxxxxxxxxxxxxxxx
Subject: Re: stateful UDP with unknown source port on INPUT?
Date: Fri, 30 Mar 2007 01:06:15 +0200
noa levy wrote:
Hi,
I am working on a machine that needs to send SNMP informs, and receive
ACKs for these informs. I am using iptables as my firewall, and I need to
find a way to open a pinhole for the ACK to get back to me. My problem is
that SNMP informs are sent to a predefined UDP port (162) but the ACKs are
returned from a random port.
The following rules exist to allow established UDP sessions:
iptables -A INPUT-p udp -m state ?state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p udp -m state ?state NEW,ESTABLISHED -j ACCEPT
My problem is that, since the source port of the ACK is a random one, the
ACKs are dropped. Is there a way to allow all incoming UDP packets with an
unknown source port and an established dest port?
Not directly, but you could use the recent match for this. On outgoing
requests, add the IP to the recent set. On incoming packets, first match on
the destination port, then match on recent to see if the IP had an recent
outgoing request.
I use a similar strategy to reject (instead of drop) indent queries from
hosts I made a tcp connection to and that works, so this should to.
HTH,
M4
_________________________________________________________________
Don't just search. Find. Check out the new MSN Search!
http://search.msn.com/
