NetFilter
[Top] [All Lists]

stateful UDP with unknown source port on INPUT?

To: netfilter@lists.netfilter.org
Subject: stateful UDP with unknown source port on INPUT?
From: "noa levy" <noalevy@hotmail.com>
Date: Wed, 21 Mar 2007 20:30:30 +0300
Bcc:
Delivered-to: sp-com-lists@consult.net
Delivered-to: netfilter-list1@securepoint.com
List-archive: </pipermail/netfilter>
List-help: <mailto:netfilter-request@lists.netfilter.org?subject=help>
List-id: General discussion and user questions <netfilter.lists.netfilter.org>
List-post: <mailto:netfilter@lists.netfilter.org>
List-subscribe: <https://lists.netfilter.org/mailman/listinfo/netfilter>, <mailto:netfilter-request@lists.netfilter.org?subject=subscribe>
List-unsubscribe: <https://lists.netfilter.org/mailman/listinfo/netfilter>, <mailto:netfilter-request@lists.netfilter.org?subject=unsubscribe>
Sender: netfilter-bounces@lists.netfilter.org
Hi,
I am working on a machine that needs to send SNMP informs, and receive ACKs for these informs. I am using iptables as my firewall, and I need to find a way to open a pinhole for the ACK to get back to me. My problem is that SNMP informs are sent to a predefined UDP port (162) but the ACKs are returned from a random port.
The following rules exist to allow established UDP sessions:
iptables -A INPUT-p udp -m state ?state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p udp -m state ?state NEW,ESTABLISHED -j ACCEPT

My problem is that, since the source port of the ACK is a random one, the ACKs are dropped. Is there a way to allow all incoming UDP packets with an unknown source port and an established dest port?

Any help will be greatly appreciated,
Thanks,
Noa

_________________________________________________________________
Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/



<Prev in Thread] Current Thread [Next in Thread>