udp connection tracking

udp connection tracking

[Steve Melo]

greetings list,

I'm having a problem with a particular online game, winning eleven soccer 8.
I need some kind of udp connection tracking and non of the helper modules
seem to help.
Firstly I'll describe what happens during the initial connection between the
server and client:

1.) first the client will choose any random port over 1064 to use for the
outgoing connection, lets use 1379 for this example.
2.) the client will send a udp packet from port 1379 to the listening port
on the server which is always 5739.
3.) the server receives the packet, then chooses a random available port of
its own, lets use 1184 for this example.
4.) the server sends a single udp packet with a src port of 1184 to the dst
port 1379 of the client.
5.) after this single packet described in step 4, all the traffic between
the client and server happen between ports 2222 and 5739.

Here is an illustrated example


 IP CLIENT.1379 > HOST.5739: UDP, length: 64
 IP HOST.1184 > CLIENT.1379: UDP, length: 84 ** this is the troublesome
packet **
 IP HOST.5739 > CLIENT.1379: UDP, length: 60
 IP HOST.5739 > CLIENT.1379: UDP, length: 60
 IP CLIENT.1379 > HOST.5739: UDP, length: 60
 IP HOST.5739 > CLIENT.1379: UDP, length: 60
 IP CLIENT.1379 > HOST.5739: UDP, length: 16
 IP HOST.5739 > CLIENT.1379: UDP, length: 60
 IP CLIENT.1379 > HOST.5739: UDP, length: 60
 IP HOST.5739 > CLIENT.1379: UDP, length: 60
 IP CLIENT.1379 > HOST.5739: UDP, length: 60

Now, my problem is when i want to connect as a client, i have no way of
knowing what port the server will choose to send that single packet (step 4
above).  I also can't guess what port my client will use (step 1 above). All
the other packets are fine because i can always expect a src or dst port
with 5739.  This single packet is causing all my connection attempts to
fail.

Is there anything i can try besides forwarding all udp traffic to the
client?

Thank you,

steve

Re: udp connection tracking

[Taylor, Grant]

> 1.) first the client will choose any random port over 1064 to use for the
> outgoing connection, lets use 1379 for this example.
> 2.) the client will send a udp packet from port 1379 to the listening port
> on the server which is always 5739.
> 3.) the server receives the packet, then chooses a random available port of
> its own, lets use 1184 for this example.
> 4.) the server sends a single udp packet with a src port of 1184 to the dst
> port 1379 of the client.
> 5.) after this single packet described in step 4, all the traffic between
> the client and server happen between ports 2222 and 5739.

This is an interesting problem.

> Now, my problem is when i want to connect as a client, i have no way of
> knowing what port the server will choose to send that single packet (step 4
> above).  I also can't guess what port my client will use (step 1 above). All
> the other packets are fine because i can always expect a src or dst port
> with 5739.  This single packet is causing all my connection attempts to
> fail.

What?  Is your psyche not working?  :P

> Is there anything i can try besides forwarding all udp traffic to the
> client?

Maybe....

I think that you might be able to do something with the recent match extension.  Seeing as how I don't have the WSWE8 game I can't test this for you.  But the idea behind it is to add the destination (IP) address of your initial packet to the server on UDP port 5379 to a recent set named WSWE8.  Subsequently any inbound UDP traffic will be checked against the recent set named WSWE8 to see if the source address is that of the server that you sent to less than 60 seconds ago.

iptables -t filter -A FORWARD -i ${LAN} -o ${INet} -p udp --sport 1024:65535 --dport 5379 -m recent --set --name WSWE8 --rdest -j ACCEPT
iptables -t filter -A FORWARD -i ${INet} -o ${LAN} -p udp -m recent --rcheck --seconds 60 --name WSWE8 --rsource -j ACCEPT

Seeing as how this one packet is the one that is troubling you I think you should fairly easily be able to integrate these rules in to your existing firewall.  Give these rules a try and see if they work for you.  If they do work for you (A - please let me know) try replacing the "--rcheck" parameter in the 2nd rule with "--remove" as this will remove the source IP from the WSWE8 recent set thus preventing any one else from doing any funny business with you.  :)



Grant. . . .

Re: udp connection tracking

[Steve Melo]

Grant,

Firstly thank you for your reply!

Currently i have a rule in my firewall that DNATS to the client machine,
I'm guessing that i will also need to DNAT that single packet but im not
sure where to place the rule.
could i use the two rules you gave me with this additional one:

iptables -t nat -A PREROUTING -i ${INet} -p udp -m recent --rcheck --seconds
60 --name WSWE8 -- source -j DNAT --to-destination $CLIENT_IP

thank you again,

-steve

Re: udp connection tracking

[Taylor, Grant]

> Firstly thank you for your reply!

You are welcome!

> Currently i have a rule in my firewall that DNATS to the client machine,
> I'm guessing that i will also need to DNAT that single packet but im not
> sure where to place the rule.
> could i use the two rules you gave me with this additional one:
> 
> iptables -t nat -A PREROUTING -i ${INet} -p udp -m recent --rcheck --seconds
> 60 --name WSWE8 -- source -j DNAT --to-destination $CLIENT_IP

Yes, you should be able to DNAT like you have suggested.  Heads up, you have "-- source" when it should be "--rsource" in your rule.  :)

> thank you again,

No problem.  This is what this list is for.

Re: udp connection tracking

[Steve Melo]

Grant,

It works! thank you so much! and this tagging/match rule will help me in my
future firewall scripts I'm sure!

-steve


----- Original Message ----- 
From: "Taylor, Grant" <gtaylor@riverviewtech.net>
To: <netfilter@lists.netfilter.org>
Sent: Tuesday, May 17, 2005 3:50 PM
Subject: Re: udp connection tracking


> > Firstly thank you for your reply!
>
> You are welcome!
>
> > Currently i have a rule in my firewall that DNATS to the client machine,
> > I'm guessing that i will also need to DNAT that single packet but im not
> > sure where to place the rule.
> > could i use the two rules you gave me with this additional one:
> >
> > iptables -t nat -A PREROUTING -i ${INet} -p udp -m
recent --rcheck --seconds
> > 60 --name WSWE8 -- source -j DNAT --to-destination $CLIENT_IP
>
> Yes, you should be able to DNAT like you have suggested.  Heads up, you
have "-- source" when it should be "--rsource" in your rule.  :)
>
> > thank you again,
>
> No problem.  This is what this list is for.
>
>

Re: udp connection tracking

[Taylor, Grant]

> It works! thank you so much! and this tagging/match rule will help me in my
> future firewall scripts I'm sure!

Great!  I'm glad that I could help.  Now we all have a solution for similar problems in the future.  :)



Grant. . . .