up vote 0 down vote favorite
share [g+] share [fb]

A central part of my firewall configuration is:

-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

It seems that RELATED does not work for multicast responses: when the host sends to a multicast group (in my case a UPnP SSDP discovery, to 239.255.255.250:1900), the corresponding responses from a specific IP address back to the sender's randomly selected port are dropped.

What is the correct way to preserve the --state ESTABLISHED,RELATED semantics, but make the response matching work for multicast?

link|improve this question
feedback

migrated from stackoverflow.com Mar 23 '11 at 13:12

This question came from our site for professional and enthusiast programmers.

1 Answer

up vote 0 down vote accepted

That's the problem with multicast: netfilter can never be sure whether it's related or not.

The only way you can allow UPnP SSDP will therefore be:

-A INPUT -p udp --sport 1900 -j ACCEPT

In addition to the existing ESTABLISHED,RELATED rule.

link|improve this answer
Well, at least in this case it seems it could -- my machine makes the initial request to a multicast address, from an ephemeral port. It thus seems reasonable to permit subsequent messages to this local port as RELATED. Am I missing something? – Christian Mar 24 '11 at 20:17
@Christian not really. In netfilter's conntrack, the addresses would be stored as "SRC=<your_IP> DST=239.255.255.250", while the reply is "SRC=<someone's_IP> DST=<your_IP>". Without a helper module, the reply looks unrelated to the original entry. Unfortunately, AFAIK there's no helper module for UPnP. – pepoluan Mar 25 '11 at 8:11
@Christian there is a way to automatically add UPnP rules into iptables, but you'll need an additional piece of software. See this page: en.gentoo-wiki.com/wiki/UPnP (it's for Gentoo, but there should be something similar if you're using other distros). – pepoluan Mar 25 '11 at 8:35
Thanks for the pointer (and sorry for the delay)! I took a look and as far as I can tell linux-igd is meant for situations where Linux is running on a gateway, so iptables can install rules as needed. For example, the manual says that to start the required daemon you need to provide internal and external interfaces. That does not apply here -- I'd simply like my client to accept the response resulting from the broadcast discovery message it sends. – Christian May 3 '11 at 23:50
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.