Re: Firewall (iptables) issues?

[Eric Norum <wenorum@lbl.gov>]

On Nov 5, 2010, at 3:50 PM, Jeff Hill wrote:

>I don't understand.  The rules that I presented are for inbound packets.

>If you want channel access _clients_ on a machine to be able to see _replies_ to broadcast PV search requests

 

> The first rule

>          -A INPUT -s 192.168.0.0/22 -p udp --sport 5064 -j ACCEPT

> takes care of incoming responses to PV search requests.

 

The server typically does not send udp response frames back to the client using port 5064

as the destination address because the client’s udp port is ephemeral (dynamically assigned).

The server instead sends it responses to a destination address which is whatever source

address it finds in the incoming udp request frame.

Right.

I think that you're missing the fact that this rule opens the firewall for packets with *source* port 5064, not with *destination* port 5064.

 

Thus enabling 5064 for the client doesn’t hurt anything, but it probably doesn’t help, actually

emasculates the firewall, and maybe it works now for you only because the stateful firewall transparently

allows replies from the server that are being sent to the client’s ephemeral port. The stateful

firewall can actually remember the source address for the search requests and briefly allow

replies sent to that same destination.

 

-- 
Eric Norum
wenorum@lbl.gov