From: Andrew Beverley <andy@andybev.com>
To: Sam Gandhi <samgandhi9@gmail.com>
Cc: netfilter@vger.kernel.org
Subject: Re: SYN, ACK, ACK PSH packets getting dropped (?)
Date: Sun, 10 Jul 2011 22:22:42 +0100 [thread overview]
Message-ID: <1310332962.2603.12.camel@andybev> (raw)
In-Reply-To: <CAOdLEarz-mG6wKMnirJi07xJfW=5A3AZUAV+cwKdbs99K=+p-w@mail.gmail.com>
On Fri, 2011-07-08 at 14:42 -0700, Sam Gandhi wrote:
> Hello,
>
> I am trying to configure small industrial device that has one ethernet
> interface ("internal") and another WLAN interface.
>
> I have attached below shell function I am using configure the iptables
> rule below. I have include a rule $IPT -A OUTPUT -j LOG
> --log-prefix "OU " at the bottom to log any packets that fall through
> the OUTPUT chain and log them. And I see following output, should be
> worried about this?
I suspect that they are packets related to NFS, in which case the answer
is yes, once you start dropping them.
> How do I go about fixing this? If anyone wants
> please do provide any suggestion on improving this iptable rule
> further. Basically what I want to do is accept DNS, NTP, COPS traffic
> over wlan0 interface and also allow NFS booting device over eth0.
NFS is a complicated protocol, and I personally have never been able to
get it properly filtered by iptables. So, unless you are paranoid about
your users on the internal network, I would just accept all INPUT
packets on eth0, and concentrate your filtering on the WLAN interface
(presumably the public facing side?)
You might also want to check this out to help with NFS:
http://www.cyberciti.biz/faq/centos-fedora-rhel-iptables-open-nfs-server-ports/
Andy
prev parent reply other threads:[~2011-07-10 21:22 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-07-08 21:42 SYN, ACK, ACK PSH packets getting dropped (?) Sam Gandhi
2011-07-10 21:22 ` Andrew Beverley [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1310332962.2603.12.camel@andybev \
--to=andy@andybev.com \
--cc=netfilter@vger.kernel.org \
--cc=samgandhi9@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox