iptables ignoring UDP? [SOLVED]

nixscripter · Posted: Wed Sep 30, 2009 4:59 am Post subject: iptables ignoring UDP? [SOLVED]

I am running a firewall, and it seems to be dropping my UDP packets. I presumed my hand-configured iptables was the problem. During my debugging, however, I was quite surprised by a result.

I decided to make sure the UDP packets were getting somewhere at all. So, I put in this rule on the firewall:

barophobia · Posted: Wed Sep 30, 2009 7:35 am Post subject: Re: iptables ignoring UDP?

Does tcp connection work? Does ping work? Does udp stuff work with another machine?

output of iptables -L -v?

turn iptables off completely?
_________________
An apple is an apple unless you say it is not an apple!

nixscripter · Posted: Wed Sep 30, 2009 12:15 pm Post subject:

This morning, it works. The UDP packet logging, that is. So they are getting there, but not being routed, as I suspected.

So, for the configuration, the basics

1. Pinging the server and any other server on the internet works.
2. All TCP services work.
3. DNS works -- but only to the firewall. The firewall is running dnsmasq.
4. DHCP works -- the firewall issues all addresses on the private network.

I have tried a lot, but here is the configuration that is failing. eth0 is the external NIC, eth1 is the internal NIC. I have also tried the RELATED,ESTABLISHED state in the FORWARD chain, but it didn't work.

barophobia · Posted: Wed Sep 30, 2009 4:04 pm Post subject:

Add a line at the end of the input table to log what is being dropped. might want to prefix it with something identifiable.

If you are doing something like below I really don't see why your udp packets are being dropped since you have it set to accept anything from eth1.

nixscripter · Posted: Thu Oct 01, 2009 12:44 am Post subject:

You got the diagram right.

I don't understand why these two rules don't match it, but they not only drop client traffic, but other UDP things on my network, too:

nixscripter · Posted: Thu Oct 01, 2009 1:21 am Post subject:

Hmm.

One thing occurred to me when I cleaned up all the print statements, and looked at the NAT rules again:

Hu · Administrator Joined: 06 Mar 2007 Posts: 23070

It is good that you provided the output of iptables-save, but you need to be a bit more precise before we can help you. Am I correct that your problem is that a privately addressed client in the LAN is unable to establish a bidirectional UDP session with a publicly addressed server on the Internet? Is the client able to use ICMP and TCP with machines on the Internet? Does tcpdump show the NAT'd packets leaving the firewall's public interface and proceeding outbound? Does it show response packets arriving on the public interface? These answers will tell us whether the problem is inappropriate NAT, a problem with the server, or a filtering problem. If it is a filtering problem, we can identify whether it occurs on the requests or on the responses.

nixscripter · Posted: Thu Oct 01, 2009 4:10 am Post subject:

Yes you would be correct. However, I just solved the problem.

I just re-wrote the same rules for the FORWARD chain different ways until I came up with this: