Re: stateful UDP with unknown source port on INPUT?

[Martijn Lievaart <m@rtij.nl>]

noa levy wrote:
> Hi,
> I am working on a machine that needs to send SNMP informs, and receive
> ACKs for these informs. I am using iptables as my firewall, and I need
> to find a way to open a pinhole for the ACK to get back to me. My
> problem is that SNMP informs are sent to a predefined UDP port (162)
> but the ACKs are returned from a random port.
> The following rules exist to allow established UDP sessions:
> iptables -A INPUT-p udp -m state –state ESTABLISHED -j ACCEPT
> iptables -A OUTPUT -p udp -m state –state NEW,ESTABLISHED -j ACCEPT
>
> My problem is that, since the source port of the ACK is a random one,
> the ACKs are dropped. Is there a way to allow all incoming UDP packets
> with an unknown source port and an established dest port?

Not directly, but you could use the recent match for this. On outgoing
requests, add the IP to the recent set. On incoming packets, first match
on the destination port, then match on recent to see if the IP had an
recent outgoing request.

I use a similar strategy to reject (instead of drop) indent queries from
hosts I made a tcp connection to and that works, so this should to.

HTH,
M4