UDP connection tracking problem

UDP connection tracking problem

[P]

Hi, I've a very simple rule set as follows, and in summary
it looks to me like udp connection tracking info
is only being updated for traffic comming into the box?

Chain INPUT (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  127.0.0.1            anywhere
ACCEPT     all  --  anywhere             anywhere           state 
RELATED,ESTABLISHED
ACCEPT     all  --  172.18.1.170         anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere           state 
NEW,RELATED,ESTABLISHED

The problem is that I can't initiate udp from this box.
If I allow udp in, I can do tftp fine.
Then removing the udp rule I can tftp fine for
variable amount of time 0s, 30s, 180s.

I'm using linux 2.4.20 and iptables v1.2.7a

cheers,
Pádraig.

Re: UDP connection tracking problem

[Padraig Brady]

P@draigBrady.com wrote:
> Hi, I've a very simple rule set as follows, and in summary
> it looks to me like udp connection tracking info
> is only being updated for traffic comming into the box?
> 
> Chain INPUT (policy DROP)
> target     prot opt source               destination
> ACCEPT     all  --  127.0.0.1            anywhere
> ACCEPT     all  --  anywhere             anywhere           state 
> RELATED,ESTABLISHED
> ACCEPT     all  --  172.18.1.170         anywhere
> 
> Chain OUTPUT (policy ACCEPT)
> target     prot opt source               destination
> ACCEPT     all  --  anywhere             anywhere           state 
> NEW,RELATED,ESTABLISHED
> 
> The problem is that I can't initiate udp from this box.
> If I allow udp in, I can do tftp fine.
> Then removing the udp rule I can tftp fine for
> variable amount of time 0s, 30s, 180s.
> 
> I'm using linux 2.4.20 and iptables v1.2.7a

Ah hang on, when the UDP is sent out, the following
is added to /proc/net/ip_conntrack as expected:
udp      17 22 src=172.18.1.55 dst=172.18.1.14 sport=32769 dport=69 
[UNREPLIED] src=172.18.1.14 dst=172.18.1.55 sport=69 dport=32769 use=1

However the response packet doesn't use 69 as the sport.
It seems to use an ephemeral one (33118) :-(

FYI the tftpd is "tftp-hpa 0.34, with remap, with tcpwrappers"

Hmm: http://www.zytor.com/pipermail/syslinux/2003-April/001851.html

Pádraig.

Re: UDP connection tracking problem

[P]

P@draigBrady.com wrote:
> Hi, I've a very simple rule set as follows, and in summary
> it looks to me like udp connection tracking info
> is only being updated for traffic comming into the box?
> 
> Chain INPUT (policy DROP)
> target     prot opt source               destination
> ACCEPT     all  --  127.0.0.1            anywhere
> ACCEPT     all  --  anywhere             anywhere           state 
> RELATED,ESTABLISHED
> ACCEPT     all  --  172.18.1.170         anywhere
> 
> Chain OUTPUT (policy ACCEPT)
> target     prot opt source               destination
> ACCEPT     all  --  anywhere             anywhere           state 
> NEW,RELATED,ESTABLISHED
> 
> The problem is that I can't initiate udp from this box.
> If I allow udp in, I can do tftp fine.
> Then removing the udp rule I can tftp fine for
> variable amount of time 0s, 30s, 180s.
> 
> I'm using linux 2.4.20 and iptables v1.2.7a

Ah hang on, when the UDP is sent out, the following
is added to /proc/net/ip_conntrack as expected:
udp      17 22 src=172.18.1.55 dst=172.18.1.14 sport=32769 dport=69 
[UNREPLIED] src=172.18.1.14 dst=172.18.1.55 sport=69 dport=32769 use=1

However the response packet doesn't use 69 as the sport.
It seems to use an ephemeral one (33118)

FYI the tftpd is "tftp-hpa 0.34, with remap, with tcpwrappers"

Hmm: http://www.zytor.com/pipermail/syslinux/2003-April/001851.html

Should udp connection tracking only use the sport
for outgoind packets and dport for incomming packets?

Pádraig.

Re: UDP connection tracking problem

[P]

Ramin Dousti wrote:
> You need ip_conntrack_tftp and ip_nat_tftp helper modules.

Great. So how do I download it?
http://lists.netfilter.org/pipermail/netfilter-devel/2003-March/010890.html

cheers,
Pádraig.

Re: TFTP connection tracking problem

[Ramin Dousti]

On Mon, Nov 10, 2003 at 05:26:18PM +0000, P@draigBrady.com wrote:

> Ramin Dousti wrote:
> >You need ip_conntrack_tftp and ip_nat_tftp helper modules.
> 
> Great. So how do I download it?
> http://lists.netfilter.org/pipermail/netfilter-devel/2003-March/010890.html

Well, good question. A quick scan through the latest pom didn't show anything.
Anyone?

Ramin

> 
> cheers,
> Pádraig.

Re: TFTP connection tracking problem

[Goetz Bock]

On Mon, Nov 10 '03 at 14:53, Ramin Dousti wrote:
> > >You need ip_conntrack_tftp and ip_nat_tftp helper modules.
> > Great. So how do I download it?
> Well, good question. A quick scan through the latest pom didn't show
> anything.
http://www.<your_mirror>.kernel.org/pub/linux/kernel/v2.4/linux-2.4.22.tar.bz2
e.g. part of stock 2.4.22
-- 
/"\ Goetz Bock at blacknet dot de  --  secure mobile Linux everNETting
\ /                     (c) 2003 as GNU FDL 1.1
 X   [ 1. Use descriptive subjects - 2. Edit a reply for brevity -  ]
/ \  [ 3. Reply to the list - 4. Read the archive *before* you post ]