Experimental Physics and
Industrial Control System

"Darren S. Dale" <[email protected]> · Thu, 4 Nov 2010 12:19:15 -0400

On Nov 4, 2010, at 12:09 PM, Eric Norum wrote:

> On Nov 4, 2010, at 8:48 AM, Matthieu Bec wrote:
> 
>> 
>> Hi Mark,
>> 
>> I left it as an unanswered question but came to the conclusion the udp destination needed to be widely open:
>> 
>> # anything on VLAN65:
>> -A INPUT -m state --state NEW -m udp -p udp -s 172.16.65.0/24 --dport 5000:65535 -j ACCEPT
>> 
>> get 'wireshark' if you cannot find ethereal for your distribution.
>> 
>> Matthieu
>> 
> 
> 
> This works, but I'm pretty sure that opening things up to that extent is going to get my machine blacklisted....
> I presume that what's happening is that my client is getting bound to some arbitrary UDP port to which the IOC then replies.
> I'm kind of surprised that this hasn't been an issue for others in the past.

I recently had the same problem. I think this was the change that took care of it:

-A INPUT -m udp -p udp --sport 5064 -j ACCEPT

Darren

Experimental Physics and Industrial Control System

Experimental Physics and
Industrial Control System