Re: iptables rules for cups printer discovery

[Grant Taylor <gtaylor@riverviewtech.net>]

On 8/14/2008 1:51 PM, Stephen Isard wrote:
> I'm wondering whether there are iptables rules that will permit cups 
> snmp printer discovery to operate without creating a serious security risk.

I wonder if you could not use the "recent" match extension to ""remember 
when a cups broadcast has gone through.  If there is a reply packet from 
a unicast IP going back to a unicast host that has recently sent a 
broadcast packet.

I suppose you would have to set / update a recent list every time a 
unicast source sends a broadcast (high -> low port) to the service in 
question.  That way you could allow the reply (low -> high port) from a 
unicast source to the unicast destination that recently sent a broadcast.

This type of rule should help by not having to allow all traffic from 
the source port through.



Grant. . . .