1

I have secured a linux box, starting with

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

and after adding rules to enable specific protocols and streams.

  • Which are the correct rules to add multicast support ?

I am trying with these - for both client and server multicast :

iptables -A INPUT  -m pkttype --pkt-type multicast -j ACCEPT
iptables -A OUTPUT -m pkttype --pkt-type multicast -j ACCEPT
iptables -A INPUT  --protocol igmp -j ACCEPT
iptables -A OUTPUT --protocol igmp -j ACCEPT
iptables -A INPUT  --dst "224.0.0.0/4" -j ACCEPT
iptables -A OUTPUT --dst "224.0.0.0/4" -j ACCEPT

Linux 2.6.38-12 / iptables 1.4.10

  • Is there any internet service to test my multicast set ( pc + adsl router + provider ) ?
Improve this question
2
  • It would be helpfull to tell us which version of netfilter/iptables do you use. If you use the distro standard, please let us know, which linux distro including version information do you use.
    – f4m8
    Nov 25, 2011 at 13:44
  • Done. Also with a new, related, question.
    – Massimo
    Nov 25, 2011 at 14:04

1 Answer 1

Reset to default
1

multicast over the global internet does not exist, it is unicast only.

If you wish to test multicast addresses, configure it within your own network.

Improve this answer
4
  • This info is incorrect. multicast works over WAN and internet, your provider have to enable and configure the routers.
    – Massimo
    Nov 27, 2011 at 13:52
  • right, via peerings to participants in the multicast group. my point still stands that the Internet as a whole does not have multicast.
    – Olipro
    Nov 27, 2011 at 20:49
  • 1
    Ok, but you don't answer my question about iptables.
    – Massimo
    Nov 30, 2011 at 7:13
  • matching on a packet type of "multicast" is sufficient depending on what overall ruleset you have configured iptables with; if all your chains are set to ACCEPT, obviously you don't need any rules at all.
    – Olipro
    Dec 9, 2011 at 2:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .