Iptables: strange way of blocking UDP traffic

Iptables: strange way of blocking UDP traffic

[massimo bortolan]

Hi all,

I have a strange and mysterious problem: my Nagios Server sends an
snmpgetnext to a SUN Server (at the virtual interface, IP:
10.10.10.10) and the response comes back from the real IP of the SUN
Server (IP: 10.10.10.1). The protocol involved is SNMP, so the traffic
is UDP on port 161.

The problem is that the Firewall on Nagios Server (RedHat ES 4.0) lets
pass some responses from SUN Server, and blocks some other responses.
Generally, after 20 snmpgetnext my iptables begins to act as a
firewall (:D) blocking the incoming traffic from SUN machine. After
3/4 snmpgetnext blocked, the firewall re-begins to let the traffic get
in.


The iptables file is written below:
----------------------------------------------------------------------------------------------------------------------------
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -j ACCEPT --dport 162
-A RH-Firewall-1-INPUT -j LOG --log-level info --log-prefix "FIREWALL LOGDROP:"
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT
--------------------------------------------------------------------------------------------------------------------

In your opinion, which could be the problem?

Really thank you for your help/opinion!

Max