Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

A central part of my firewall configuration is:

-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

It seems that RELATED does not work for multicast responses: when the host sends to a multicast group (in my case a UPnP SSDP discovery, to 239.255.255.250:1900), the corresponding responses from a specific IP address back to the sender's randomly selected port are dropped.

What is the correct way to preserve the --state ESTABLISHED,RELATED semantics, but make the response matching work for multicast?

share|improve this question

migrated from stackoverflow.com Mar 23 '11 at 13:12

This question came from our site for professional and enthusiast programmers.

1 Answer 1

up vote 0 down vote accepted

That's the problem with multicast: netfilter can never be sure whether it's related or not.

The only way you can allow UPnP SSDP will therefore be:

-A INPUT -p udp --sport 1900 -j ACCEPT

In addition to the existing ESTABLISHED,RELATED rule.

share|improve this answer
    
Well, at least in this case it seems it could -- my machine makes the initial request to a multicast address, from an ephemeral port. It thus seems reasonable to permit subsequent messages to this local port as RELATED. Am I missing something? –  Christian Mar 24 '11 at 20:17
    
@Christian not really. In netfilter's conntrack, the addresses would be stored as "SRC=<your_IP> DST=239.255.255.250", while the reply is "SRC=<someone's_IP> DST=<your_IP>". Without a helper module, the reply looks unrelated to the original entry. Unfortunately, AFAIK there's no helper module for UPnP. –  pepoluan Mar 25 '11 at 8:11
    
@Christian there is a way to automatically add UPnP rules into iptables, but you'll need an additional piece of software. See this page: en.gentoo-wiki.com/wiki/UPnP (it's for Gentoo, but there should be something similar if you're using other distros). –  pepoluan Mar 25 '11 at 8:35
    
Thanks for the pointer (and sorry for the delay)! I took a look and as far as I can tell linux-igd is meant for situations where Linux is running on a gateway, so iptables can install rules as needed. For example, the manual says that to start the required daemon you need to provide internal and external interfaces. That does not apply here -- I'd simply like my client to accept the response resulting from the broadcast discovery message it sends. –  Christian May 3 '11 at 23:50
    
this doesnt seem to work for SDP Keep alive –  purpletech Oct 24 at 23:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.