* iptables dropping multicast packets
@ 2016-09-17 0:32 Robert Watson
2016-09-17 11:48 ` /dev/rob0
0 siblings, 1 reply; 2+ messages in thread
From: Robert Watson @ 2016-09-17 0:32 UTC (permalink / raw)
To: netfilter
I'm having trouble with iptables filtering out multicast ssdp packets
I created a custom MULTICAST chain to help debug but I'm still getting
dropped input multicast packets.
Here is my iptables....
# Generated by iptables-save v1.4.21 on Thu Sep 15 22:26:20 2016
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
:MULTICAST - [0:0]
-A INPUT -m conntrack --ctstate INVALID -j LOG --log-prefix "DROP
INVALID " --log-tcp-options --log-ip-options
-A INPUT -m conntrack --ctstate INVALID -j DROP
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT ! -s 10.20.30.0/24 -i lan -j LOG --log-prefix "SPOOFED PKT "
-A INPUT ! -s 10.20.30.0/24 -i lan -j DROP
-A INPUT ! -i lo -j LOG --log-prefix "INPUT DROP " --log-tcp-options
--log-ip-options
-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -d 224.0.0.0/4 -j MULTICAST
-A INPUT -s 10.20.30.0/24 -i lan -p udp -m udp --sport 67 --dport 67
-m conntrack --ctstate NEW -j ACCEPT
-A INPUT -s 10.20.30.0/24 -i lan -p udp -m udp --sport 68 --dport 68
-m conntrack --ctstate NEW -j ACCEPT
-A INPUT -s 10.20.30.0/24 -i lan -p udp -m udp --dport 2535 -m
conntrack --ctstate NEW -j ACCEPT
-A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 53 -m conntrack
--ctstate NEW -j ACCEPT
-A INPUT -s 10.20.30.0/24 -i lan -p udp -m udp --dport 53 -m conntrack
--ctstate NEW -j ACCEPT
-A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 20 -m conntrack
--ctstate NEW -j ACCEPT
-A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 21 -m conntrack
--ctstate NEW -j ACCEPT
-A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 3689 -m
conntrack --ctstate NEW -j ACCEPT
-A INPUT -s 10.20.30.0/24 -i lan -p udp -m udp --dport 39294 -m
conntrack --ctstate NEW -j ACCEPT
-A INPUT -s 10.20.30.0/24 -i lan -p udp -m udp --dport 40306 -m
conntrack --ctstate NEW -j ACCEPT
-A INPUT -s 10.20.30.0/24 -p tcp -m tcp --dport 3128 -m conntrack
--ctstate NEW -j ACCEPT
-A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 111 -m
conntrack --ctstate NEW -j ACCEPT
-A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 2049 -m
conntrack --ctstate NEW -j ACCEPT
-A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 20048 -m
conntrack --ctstate NEW -j ACCEPT
-A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 32765 -m
conntrack --ctstate NEW -j ACCEPT
-A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 32803 -m
conntrack --ctstate NEW -j ACCEPT
-A INPUT -s 10.20.30.0/24 -i lan -p udp -m udp --dport 111 -m
conntrack --ctstate NEW -j ACCEPT
-A INPUT -s 10.20.30.0/24 -i lan -p udp -m udp --dport 2049 -m
conntrack --ctstate NEW -j ACCEPT
-A INPUT -s 10.20.30.0/24 -i lan -p udp -m udp --dport 20048 -m
conntrack --ctstate NEW -j ACCEPT
-A INPUT -s 10.20.30.0/24 -i lan -p udp -m udp --dport 32764 -m
conntrack --ctstate NEW -j ACCEPT
-A INPUT -s 10.20.30.0/24 -i lan -p udp -m udp --dport 32765 -m
conntrack --ctstate NEW -j ACCEPT
-A INPUT -s 10.20.30.0/24 -i lan -p udp -m udp --dport 32766 -m
conntrack --ctstate NEW -j ACCEPT
-A INPUT -s 10.20.30.0/24 -i lan -p udp -m udp --dport 32803 -m
conntrack --ctstate NEW -j ACCEPT
-A INPUT -s 10.20.30.0/24 -i lan -p udp -m udp --sport 123 --dport 123
-m conntrack --ctstate NEW -j ACCEPT
-A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 88 -m conntrack
--ctstate NEW -j ACCEPT
-A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 135 -m
conntrack --ctstate NEW -j ACCEPT
-A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 139 -m
conntrack --ctstate NEW -j ACCEPT
-A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 389 -m
conntrack --ctstate NEW -j ACCEPT
-A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 445 -m
conntrack --ctstate NEW -j ACCEPT
-A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 464 -m
conntrack --ctstate NEW -j ACCEPT
-A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 636 -m
conntrack --ctstate NEW -j ACCEPT
-A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 1024 -m
conntrack --ctstate NEW -j ACCEPT
-A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 3268 -m
conntrack --ctstate NEW -j ACCEPT
-A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 3269 -m
conntrack --ctstate NEW -j ACCEPT
-A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 5722 -m
conntrack --ctstate NEW -j ACCEPT
-A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 9389 -m
conntrack --ctstate NEW -j ACCEPT
-A INPUT -s 10.20.30.0/24 -i lan -p udp -m udp --dport 88 -m conntrack
--ctstate NEW -j ACCEPT
-A INPUT -s 10.20.30.0/24 -i lan -p udp -m udp --dport 137 -m
conntrack --ctstate NEW -j ACCEPT
-A INPUT -s 10.20.30.0/24 -i lan -p udp -m udp --dport 138 -m
conntrack --ctstate NEW -j ACCEPT
-A INPUT -s 10.20.30.0/24 -i lan -p udp -m udp --dport 389 -m
conntrack --ctstate NEW -j ACCEPT
-A INPUT -s 10.20.30.0/24 -i lan -p udp -m udp --dport 445 -m
conntrack --ctstate NEW -j ACCEPT
-A INPUT -s 10.20.30.0/24 -i lan -p udp -m udp --dport 464 -m
conntrack --ctstate NEW -j ACCEPT
-A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 3483 -m
conntrack --ctstate NEW -j ACCEPT
-A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 9000 -m
conntrack --ctstate NEW -j ACCEPT
-A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 9090 -m
conntrack --ctstate NEW -j ACCEPT
-A INPUT -s 10.20.30.0/24 -i lan -p udp -m udp --dport 3483 -m
conntrack --ctstate NEW -j ACCEPT
-A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 22 -m conntrack
--ctstate NEW -j ACCEPT
-A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 8080 -m
conntrack --ctstate NEW -j ACCEPT
-A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 8081 -m
conntrack --ctstate NEW -j ACCEPT
-A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 8443 -m
conntrack --ctstate NEW -j ACCEPT
-A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 8843 -m
conntrack --ctstate NEW -j ACCEPT
-A INPUT -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 8880 -m
conntrack --ctstate NEW -j ACCEPT
-A INPUT -s 10.20.30.0/24 -i lan -p udp -m udp --dport 3478 -m
conntrack --ctstate NEW -j ACCEPT
-A INPUT -s 10.20.30.0/24 -i lan -p udp -m udp --dport 10001 -m
conntrack --ctstate NEW -j ACCEPT
-A FORWARD -m conntrack --ctstate INVALID -j LOG --log-prefix "DROP
INVALID " --log-tcp-options --log-ip-options
-A FORWARD -m conntrack --ctstate INVALID -j DROP
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD ! -i lo -j LOG --log-prefix "FORWARD DROP "
--log-tcp-options --log-ip-options
-A FORWARD ! -s 10.20.30.0/24 -i lan -j LOG --log-prefix "SPOOFED PKT "
-A FORWARD ! -s 10.20.30.0/24 -i lan -j DROP
-A FORWARD -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A FORWARD -s 10.20.30.0/24 -i lan -p tcp -m multiport --dports 20,21
-m conntrack --ctstate NEW -j ACCEPT
-A FORWARD -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 9418 -m
conntrack --ctstate NEW -j ACCEPT
-A FORWARD -p tcp -m tcp --dport 11371 -m conntrack --ctstate NEW -j ACCEPT
-A FORWARD -s 10.20.30.0/24 -i lan -p udp -m udp --dport 16403:16472
-m conntrack --ctstate NEW -j ACCEPT
-A FORWARD -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 22 -m
conntrack --ctstate NEW -j ACCEPT
-A FORWARD -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 447 -m
conntrack --ctstate NEW -j ACCEPT
-A FORWARD -s 10.20.30.0/24 -i lan -p tcp -m multiport --dports
43,4321 -m conntrack --ctstate NEW -j ACCEPT
-A FORWARD -s 10.20.30.0/24 -i lan -p tcp -m multiport --dports 80,443
-m conntrack --ctstate NEW -j ACCEPT
-A FORWARD -s 10.20.30.0/24 -i lan -p udp -m multiport --dports 80,443
-m conntrack --ctstate NEW -j ACCEPT
-A OUTPUT -m conntrack --ctstate INVALID -j LOG --log-prefix "DROP
INVALID " --log-tcp-options --log-ip-options
-A OUTPUT -m conntrack --ctstate INVALID -j DROP
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT ! -o lo -j LOG --log-prefix "OUTPUT DROP " --log-tcp-options
--log-ip-options
-A OUTPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -d 10.20.30.0/24 -m pkttype --pkt-type multicast -j ACCEPT
-A OUTPUT -d 10.20.30.0/24 -p udp -m udp --sport 67:68 --dport 67:68
-m conntrack --ctstate NEW -j ACCEPT
-A OUTPUT -d 10.20.30.0/24 -p udp -m udp --dport 2535 -m conntrack
--ctstate NEW -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
-A OUTPUT -p udp -m udp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
-A OUTPUT -p tcp -m multiport --dports 20,21 -m conntrack --ctstate
NEW -j ACCEPT
-A OUTPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate
NEW -j ACCEPT
-A OUTPUT -p udp -m multiport --dports 80,443 -m conntrack --ctstate
NEW -j ACCEPT
-A OUTPUT -d 10.20.30.0/24 -p tcp -m tcp --dport 3689 -m conntrack
--ctstate NEW -j ACCEPT
-A OUTPUT -d 10.20.30.0/24 -p udp -m multiport --dports 40306,39294 -m
conntrack --ctstate NEW -j ACCEPT
-A OUTPUT -d 10.20.30.0/24 -p tcp -m multiport --dports
111,2049,20048,32764:32769,32803 -m conntrack --ctstate NEW -j ACCEPT
-A OUTPUT -d 10.20.30.0/24 -p udp -m multiport --dports
111,2049,20048,32764:32769,32803 -m conntrack --ctstate NEW -j ACCEPT
-A OUTPUT -p udp -m udp --sport 123 --dport 123 -m conntrack --ctstate
NEW -j ACCEPT
-A OUTPUT -p udp -m udp --sport 3483 -m conntrack --ctstate NEW -j ACCEPT
-A OUTPUT -p tcp -m multiport --sports 3483,9000,9090 -m conntrack
--ctstate NEW -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -j ACCEPT
-A OUTPUT -p tcp -m multiport --dports 43,4321 -m conntrack --ctstate
NEW -j ACCEPT
-A OUTPUT -d 10.20.30.0/24 -p tcp -m tcp --dport 591 -m conntrack
--ctstate NEW -j ACCEPT
-A OUTPUT -d 10.20.30.0/24 -p tcp -m tcp --dport 8081 -m conntrack
--ctstate NEW -j ACCEPT
-A OUTPUT -d 10.20.30.0/24 -p tcp -m tcp --dport 8443 -m conntrack
--ctstate NEW -j ACCEPT
-A OUTPUT -d 10.20.30.0/24 -p tcp -m tcp --dport 8880 -m conntrack
--ctstate NEW -j ACCEPT
-A OUTPUT -d 10.20.30.0/24 -p tcp -m tcp --dport 8343 -m conntrack
--ctstate NEW -j ACCEPT
-A OUTPUT -d 10.20.30.0/24 -p udp -m udp --dport 3478 -m conntrack
--ctstate NEW -j ACCEPT
-A OUTPUT -d 10.20.30.0/24 -p udp -m udp --dport 10001 -m conntrack
--ctstate NEW -j ACCEPT
-A MULTICAST ! -o lo -j LOG --log-prefix "MULTICAST DROP "
--log-tcp-options --log-ip-options
-A MULTICAST -p udp -m udp --dport 1900 -j ACCEPT
-A MULTICAST -j DROP
COMMIT
# Completed on Thu Sep 15 22:26:20 2016
# Generated by iptables-save v1.4.21 on Thu Sep 15 22:26:20 2016
*nat
:PREROUTING ACCEPT [60:3950]
:INPUT ACCEPT [87:5354]
:OUTPUT ACCEPT [238:17029]
:POSTROUTING ACCEPT [238:17029]
-A PREROUTING -i net0 -p tcp -m tcp --dport 3389 -j DNAT
--to-destination 10.20.30.4:3389
-A PREROUTING -s 10.20.30.0/24 -i lan -p tcp -m tcp --dport 80 -j
REDIRECT --to-ports 3128
-A POSTROUTING -s 10.20.30.0/24 -o net0 -j MASQUERADE
COMMIT
# Completed on Thu Sep 15 22:26:20 2016
Here is the output from the journalctl -xe | grep "1900"
kernel: INPUT DROP IN=lan OUT=
MAC=01:00:5e:7f:ff:fa:24:0a:64:fe:cb:65:08:00 SRC=10.20.30.38
DST=239.255.255.250 LEN=165 TOS=0x00 PREC=0x00 TTL=4 ID=3831 PROTO=UDP
SPT=64585 DPT=1900 LEN=145
kernel: MULTICAST DROP IN=lan OUT=
MAC=01:00:5e:7f:ff:fa:24:0a:64:fe:cb:65:08:00 SRC=10.20.30.38
DST=239.255.255.250 LEN=165 TOS=0x00 PREC=0x00 TTL=4 ID=3831 PROTO=UDP
SPT=64585 DPT=1900 LEN=145
I don't understand why these packets are dropped...
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: iptables dropping multicast packets
2016-09-17 0:32 iptables dropping multicast packets Robert Watson
@ 2016-09-17 11:48 ` /dev/rob0
0 siblings, 0 replies; 2+ messages in thread
From: /dev/rob0 @ 2016-09-17 11:48 UTC (permalink / raw)
To: netfilter
On Fri, Sep 16, 2016 at 05:32:02PM -0700, Robert Watson wrote:
> I'm having trouble with iptables filtering out multicast ssdp
> packets I created a custom MULTICAST chain to help debug but I'm
> still getting dropped input multicast packets.
Are you? I don't think so.
> Here is my iptables....
> # Generated by iptables-save v1.4.21 on Thu Sep 15 22:26:20 2016
> *filter
> :INPUT DROP [0:0]
> :FORWARD DROP [0:0]
> :OUTPUT DROP [0:0]
> :MULTICAST - [0:0]
> -A INPUT -m conntrack --ctstate INVALID -j LOG --log-prefix "DROP INVALID " --log-tcp-options --log-ip-options
> -A INPUT -m conntrack --ctstate INVALID -j DROP
> -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
> -A INPUT ! -s 10.20.30.0/24 -i lan -j LOG --log-prefix "SPOOFED PKT "
> -A INPUT ! -s 10.20.30.0/24 -i lan -j DROP
You're fine up to here.
> -A INPUT ! -i lo -j LOG --log-prefix "INPUT DROP " --log-tcp-options --log-ip-options
This rule logs "INPUT DROP " on anything not coming in via the
loopback interface.
> -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
> -A INPUT -i lo -j ACCEPT
> -A INPUT -d 224.0.0.0/4 -j MULTICAST
But here, you're sending those already logged packets to your
"MULTICAST" chain.
[big snip]
Look at this chain carefully:
> -A MULTICAST ! -o lo -j LOG --log-prefix "MULTICAST DROP " --log-tcp-options --log-ip-options
You log that the packet is dropped. Note that all packets logged
here were already logged with the "INPUT DROP " prefix. Note also
that the "! -o lo" is a no-op on INPUT, and this chain was called
from INPUT.
> -A MULTICAST -p udp -m udp --dport 1900 -j ACCEPT
But these packets are NOT dropped.
> -A MULTICAST -j DROP
snip
> Here is the output from the journalctl -xe | grep "1900"
>
> kernel: INPUT DROP IN=lan OUT=
> MAC=01:00:5e:7f:ff:fa:24:0a:64:fe:cb:65:08:00 SRC=10.20.30.38
> DST=239.255.255.250 LEN=165 TOS=0x00 PREC=0x00 TTL=4 ID=3831
> PROTO=UDP SPT=64585 DPT=1900 LEN=145
>
> kernel: MULTICAST DROP IN=lan OUT=
> MAC=01:00:5e:7f:ff:fa:24:0a:64:fe:cb:65:08:00 SRC=10.20.30.38
> DST=239.255.255.250 LEN=165 TOS=0x00 PREC=0x00 TTL=4 ID=3831
> PROTO=UDP SPT=64585 DPT=1900 LEN=145
>
> I don't understand why these packets are dropped...
It's the same packet; it was not dropped by these rules. PEBKAC.
--
http://rob0.nodns4.us/
Offlist GMX mail is seen only if "/dev/rob0" is in the Subject:
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2016-09-17 11:48 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-09-17 0:32 iptables dropping multicast packets Robert Watson
2016-09-17 11:48 ` /dev/rob0
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.