I'm having trouble with iptables filtering out multicast ssdp packets I created a custom MULTICAST chain to help debug but I'm still getting dropped input multicast packets. Here is my iptables.... # Generated by iptables-save v1.4.21 on Thu Sep 15 22:26:20 2016 *filter :INPUT DROP [0:0] :FORWARD DROP [0:0] :OUTPUT DROP [0:0] :MULTICAST - [0:0] -A INPUT -m conntrack --ctstate INVALID -j LOG --log-prefix "DROP INVALID " --log-tcp-options --log-ip-options -A INPUT -m conntrack --ctstate INVALID -j DROP -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A INPUT ! -s 10.20.30.0/24 -i lan -j LOG --log-prefix "SPOOFED PKT " -A INPUT ! -s 10.20.30.0/24 -i lan -j DROP -A INPUT ! -i lo -j LOG --log-prefix "INPUT DROP " --log-tcp-options --log-ip-options -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -d 224.0.0.0/4 -j MULTICAST -A INPUT -s 10.20.30.0/24 -i lan -p udp -m udp --sport 67 --dport 67 -m conntrack --ctstate NEW -j ACCEPT -A INPUT -s 10.20.30.0/24 -i lan -p udp -m udp --sport 68 --dport 68 -m conntrack --ctstate NEW -j ACCEPT -A INPUT -s 10.20.30.0/24 -i lan -p udp -m udp --dport 2535 -m conntrack --ctstate NEW -j ACCEPT -A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 53 -m conntrack --ctstate NEW -j ACCEPT -A INPUT -s 10.20.30.0/24 -i lan -p udp -m udp --dport 53 -m conntrack --ctstate NEW -j ACCEPT -A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 20 -m conntrack --ctstate NEW -j ACCEPT -A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 21 -m conntrack --ctstate NEW -j ACCEPT -A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 3689 -m conntrack --ctstate NEW -j ACCEPT -A INPUT -s 10.20.30.0/24 -i lan -p udp -m udp --dport 39294 -m conntrack --ctstate NEW -j ACCEPT -A INPUT -s 10.20.30.0/24 -i lan -p udp -m udp --dport 40306 -m conntrack --ctstate NEW -j ACCEPT -A INPUT -s 10.20.30.0/24 -p tcp -m tcp --dport 3128 -m conntrack --ctstate NEW -j ACCEPT -A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 111 -m conntrack --ctstate NEW -j ACCEPT -A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 2049 -m conntrack --ctstate NEW -j ACCEPT -A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 20048 -m conntrack --ctstate NEW -j ACCEPT -A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 32765 -m conntrack --ctstate NEW -j ACCEPT -A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 32803 -m conntrack --ctstate NEW -j ACCEPT -A INPUT -s 10.20.30.0/24 -i lan -p udp -m udp --dport 111 -m conntrack --ctstate NEW -j ACCEPT -A INPUT -s 10.20.30.0/24 -i lan -p udp -m udp --dport 2049 -m conntrack --ctstate NEW -j ACCEPT -A INPUT -s 10.20.30.0/24 -i lan -p udp -m udp --dport 20048 -m conntrack --ctstate NEW -j ACCEPT -A INPUT -s 10.20.30.0/24 -i lan -p udp -m udp --dport 32764 -m conntrack --ctstate NEW -j ACCEPT -A INPUT -s 10.20.30.0/24 -i lan -p udp -m udp --dport 32765 -m conntrack --ctstate NEW -j ACCEPT -A INPUT -s 10.20.30.0/24 -i lan -p udp -m udp --dport 32766 -m conntrack --ctstate NEW -j ACCEPT -A INPUT -s 10.20.30.0/24 -i lan -p udp -m udp --dport 32803 -m conntrack --ctstate NEW -j ACCEPT -A INPUT -s 10.20.30.0/24 -i lan -p udp -m udp --sport 123 --dport 123 -m conntrack --ctstate NEW -j ACCEPT -A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 88 -m conntrack --ctstate NEW -j ACCEPT -A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 135 -m conntrack --ctstate NEW -j ACCEPT -A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 139 -m conntrack --ctstate NEW -j ACCEPT -A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 389 -m conntrack --ctstate NEW -j ACCEPT -A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 445 -m conntrack --ctstate NEW -j ACCEPT -A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 464 -m conntrack --ctstate NEW -j ACCEPT -A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 636 -m conntrack --ctstate NEW -j ACCEPT -A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 1024 -m conntrack --ctstate NEW -j ACCEPT -A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 3268 -m conntrack --ctstate NEW -j ACCEPT -A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 3269 -m conntrack --ctstate NEW -j ACCEPT -A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 5722 -m conntrack --ctstate NEW -j ACCEPT -A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 9389 -m conntrack --ctstate NEW -j ACCEPT -A INPUT -s 10.20.30.0/24 -i lan -p udp -m udp --dport 88 -m conntrack --ctstate NEW -j ACCEPT -A INPUT -s 10.20.30.0/24 -i lan -p udp -m udp --dport 137 -m conntrack --ctstate NEW -j ACCEPT -A INPUT -s 10.20.30.0/24 -i lan -p udp -m udp --dport 138 -m conntrack --ctstate NEW -j ACCEPT -A INPUT -s 10.20.30.0/24 -i lan -p udp -m udp --dport 389 -m conntrack --ctstate NEW -j ACCEPT -A INPUT -s 10.20.30.0/24 -i lan -p udp -m udp --dport 445 -m conntrack --ctstate NEW -j ACCEPT -A INPUT -s 10.20.30.0/24 -i lan -p udp -m udp --dport 464 -m conntrack --ctstate NEW -j ACCEPT -A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 3483 -m conntrack --ctstate NEW -j ACCEPT -A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 9000 -m conntrack --ctstate NEW -j ACCEPT -A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 9090 -m conntrack --ctstate NEW -j ACCEPT -A INPUT -s 10.20.30.0/24 -i lan -p udp -m udp --dport 3483 -m conntrack --ctstate NEW -j ACCEPT -A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT -A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 8080 -m conntrack --ctstate NEW -j ACCEPT -A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 8081 -m conntrack --ctstate NEW -j ACCEPT -A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 8443 -m conntrack --ctstate NEW -j ACCEPT -A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 8843 -m conntrack --ctstate NEW -j ACCEPT -A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 8880 -m conntrack --ctstate NEW -j ACCEPT -A INPUT -s 10.20.30.0/24 -i lan -p udp -m udp --dport 3478 -m conntrack --ctstate NEW -j ACCEPT -A INPUT -s 10.20.30.0/24 -i lan -p udp -m udp --dport 10001 -m conntrack --ctstate NEW -j ACCEPT -A FORWARD -m conntrack --ctstate INVALID -j LOG --log-prefix "DROP INVALID " --log-tcp-options --log-ip-options -A FORWARD -m conntrack --ctstate INVALID -j DROP -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A FORWARD ! -i lo -j LOG --log-prefix "FORWARD DROP " --log-tcp-options --log-ip-options -A FORWARD ! -s 10.20.30.0/24 -i lan -j LOG --log-prefix "SPOOFED PKT " -A FORWARD ! -s 10.20.30.0/24 -i lan -j DROP -A FORWARD -p icmp -m icmp --icmp-type 8 -j ACCEPT -A FORWARD -s 10.20.30.0/24 -i lan -p tcp -m multiport --dports 20,21 -m conntrack --ctstate NEW -j ACCEPT -A FORWARD -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 9418 -m conntrack --ctstate NEW -j ACCEPT -A FORWARD -p tcp -m tcp --dport 11371 -m conntrack --ctstate NEW -j ACCEPT -A FORWARD -s 10.20.30.0/24 -i lan -p udp -m udp --dport 16403:16472 -m conntrack --ctstate NEW -j ACCEPT -A FORWARD -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT -A FORWARD -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 447 -m conntrack --ctstate NEW -j ACCEPT -A FORWARD -s 10.20.30.0/24 -i lan -p tcp -m multiport --dports 43,4321 -m conntrack --ctstate NEW -j ACCEPT -A FORWARD -s 10.20.30.0/24 -i lan -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW -j ACCEPT -A FORWARD -s 10.20.30.0/24 -i lan -p udp -m multiport --dports 80,443 -m conntrack --ctstate NEW -j ACCEPT -A OUTPUT -m conntrack --ctstate INVALID -j LOG --log-prefix "DROP INVALID " --log-tcp-options --log-ip-options -A OUTPUT -m conntrack --ctstate INVALID -j DROP -A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A OUTPUT ! -o lo -j LOG --log-prefix "OUTPUT DROP " --log-tcp-options --log-ip-options -A OUTPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT -A OUTPUT -o lo -j ACCEPT -A OUTPUT -d 10.20.30.0/24 -m pkttype --pkt-type multicast -j ACCEPT -A OUTPUT -d 10.20.30.0/24 -p udp -m udp --sport 67:68 --dport 67:68 -m conntrack --ctstate NEW -j ACCEPT -A OUTPUT -d 10.20.30.0/24 -p udp -m udp --dport 2535 -m conntrack --ctstate NEW -j ACCEPT -A OUTPUT -p tcp -m tcp --dport 53 -m conntrack --ctstate NEW -j ACCEPT -A OUTPUT -p udp -m udp --dport 53 -m conntrack --ctstate NEW -j ACCEPT -A OUTPUT -p tcp -m multiport --dports 20,21 -m conntrack --ctstate NEW -j ACCEPT -A OUTPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW -j ACCEPT -A OUTPUT -p udp -m multiport --dports 80,443 -m conntrack --ctstate NEW -j ACCEPT -A OUTPUT -d 10.20.30.0/24 -p tcp -m tcp --dport 3689 -m conntrack --ctstate NEW -j ACCEPT -A OUTPUT -d 10.20.30.0/24 -p udp -m multiport --dports 40306,39294 -m conntrack --ctstate NEW -j ACCEPT -A OUTPUT -d 10.20.30.0/24 -p tcp -m multiport --dports 111,2049,20048,32764:32769,32803 -m conntrack --ctstate NEW -j ACCEPT -A OUTPUT -d 10.20.30.0/24 -p udp -m multiport --dports 111,2049,20048,32764:32769,32803 -m conntrack --ctstate NEW -j ACCEPT -A OUTPUT -p udp -m udp --sport 123 --dport 123 -m conntrack --ctstate NEW -j ACCEPT -A OUTPUT -p udp -m udp --sport 3483 -m conntrack --ctstate NEW -j ACCEPT -A OUTPUT -p tcp -m multiport --sports 3483,9000,9090 -m conntrack --ctstate NEW -j ACCEPT -A OUTPUT -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT -A OUTPUT -p tcp -m multiport --dports 43,4321 -m conntrack --ctstate NEW -j ACCEPT -A OUTPUT -d 10.20.30.0/24 -p tcp -m tcp --dport 591 -m conntrack --ctstate NEW -j ACCEPT -A OUTPUT -d 10.20.30.0/24 -p tcp -m tcp --dport 8081 -m conntrack --ctstate NEW -j ACCEPT -A OUTPUT -d 10.20.30.0/24 -p tcp -m tcp --dport 8443 -m conntrack --ctstate NEW -j ACCEPT -A OUTPUT -d 10.20.30.0/24 -p tcp -m tcp --dport 8880 -m conntrack --ctstate NEW -j ACCEPT -A OUTPUT -d 10.20.30.0/24 -p tcp -m tcp --dport 8343 -m conntrack --ctstate NEW -j ACCEPT -A OUTPUT -d 10.20.30.0/24 -p udp -m udp --dport 3478 -m conntrack --ctstate NEW -j ACCEPT -A OUTPUT -d 10.20.30.0/24 -p udp -m udp --dport 10001 -m conntrack --ctstate NEW -j ACCEPT -A MULTICAST ! -o lo -j LOG --log-prefix "MULTICAST DROP " --log-tcp-options --log-ip-options -A MULTICAST -p udp -m udp --dport 1900 -j ACCEPT -A MULTICAST -j DROP COMMIT # Completed on Thu Sep 15 22:26:20 2016 # Generated by iptables-save v1.4.21 on Thu Sep 15 22:26:20 2016 *nat :PREROUTING ACCEPT [60:3950] :INPUT ACCEPT [87:5354] :OUTPUT ACCEPT [238:17029] :POSTROUTING ACCEPT [238:17029] -A PREROUTING -i net0 -p tcp -m tcp --dport 3389 -j DNAT --to-destination 10.20.30.4:3389 -A PREROUTING -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128 -A POSTROUTING -s 10.20.30.0/24 -o net0 -j MASQUERADE COMMIT # Completed on Thu Sep 15 22:26:20 2016 Here is the output from the journalctl -xe | grep "1900" kernel: INPUT DROP IN=lan OUT= MAC=01:00:5e:7f:ff:fa:24:0a:64:fe:cb:65:08:00 SRC=10.20.30.38 DST=239.255.255.250 LEN=165 TOS=0x00 PREC=0x00 TTL=4 ID=3831 PROTO=UDP SPT=64585 DPT=1900 LEN=145 kernel: MULTICAST DROP IN=lan OUT= MAC=01:00:5e:7f:ff:fa:24:0a:64:fe:cb:65:08:00 SRC=10.20.30.38 DST=239.255.255.250 LEN=165 TOS=0x00 PREC=0x00 TTL=4 ID=3831 PROTO=UDP SPT=64585 DPT=1900 LEN=145 I don't understand why these packets are dropped... -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
