Re: UDP connection tracking problem

[P@draigBrady.com]

P@draigBrady.com wrote:
> Hi, I've a very simple rule set as follows, and in summary
> it looks to me like udp connection tracking info
> is only being updated for traffic comming into the box?
> 
> Chain INPUT (policy DROP)
> target     prot opt source               destination
> ACCEPT     all  --  127.0.0.1            anywhere
> ACCEPT     all  --  anywhere             anywhere           state 
> RELATED,ESTABLISHED
> ACCEPT     all  --  172.18.1.170         anywhere
> 
> Chain OUTPUT (policy ACCEPT)
> target     prot opt source               destination
> ACCEPT     all  --  anywhere             anywhere           state 
> NEW,RELATED,ESTABLISHED
> 
> The problem is that I can't initiate udp from this box.
> If I allow udp in, I can do tftp fine.
> Then removing the udp rule I can tftp fine for
> variable amount of time 0s, 30s, 180s.
> 
> I'm using linux 2.4.20 and iptables v1.2.7a

Ah hang on, when the UDP is sent out, the following
is added to /proc/net/ip_conntrack as expected:
udp      17 22 src=172.18.1.55 dst=172.18.1.14 sport=32769 dport=69 
[UNREPLIED] src=172.18.1.14 dst=172.18.1.55 sport=69 dport=32769 use=1

However the response packet doesn't use 69 as the sport.
It seems to use an ephemeral one (33118)

FYI the tftpd is "tftp-hpa 0.34, with remap, with tcpwrappers"

Hmm: http://www.zytor.com/pipermail/syslinux/2003-April/001851.html

Should udp connection tracking only use the sport
for outgoind packets and dport for incomming packets?

Pádraig.