Re: iptables UDP problem

["Alexander W. Janssen" <alexander.janssen@gmx.de>]

[-- Attachment #1: Type: text/plain, Size: 1768 bytes --]

On Sat, Feb 01, 2003 at 04:11:50PM -0800, k n wrote:
> Hi,
> 
> I'm using iptables on RedHat 8 with the rules listed
> below. When scanned from outside the TCP port appear
> as filtered; however, the UDP port is still open.
> 
> $ip0  is my external IP address.
> 
> Am I doing something wrong?

that the TCP-port shows up as filtered is normal since you just DROP the
SYN-packets. If you wouldn't have a firewall and there would not be daemon
running the machine would send a tcp-reset packet and send it back to nmap.
This is interpreted as "connection refused", meaning that there is not a
server running on the tcp-port.

That UDP stuff surprises me a bit; if you send a packet to a UDP port and no
server is running the machine would generate an ICMP port-unreachable message
which should have been interpreted by nmap. But since you drop all packets to
53/udp a ICMP-message was never generated and nmap couldn't have received one.

I just tested on my machine (locally with loopback and nmap 2.54BETA22):

Nonfiltered udp-ports show up as "closed"
DROPed udp-ports show up as "open"

Maybe nmap interprets it like that "as long as i don't get any errors i threat
it like it would be open." And this sort of correct as well, since you don't
have a "real connection" like in TCP - the application has to do everything on
it's own. So that UDP-stuff doesn't surprise me anymore ;-)

Don't DROP. Send real tcp-resets for unwanted TCP-connections and send real
ICMP port-unreachable messages for unwanted UDP-connections and everything
else. Just my 2c.

HTH, Alex.

-- 
"Mr Data, when I said 'Fire at Will', I didn't mean for you to be so literal."
Instructions for use of this post: Insert tounge in cheek. Read as normal.

[-- Attachment #2: Type: application/pgp-signature, Size: 248 bytes --]