Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

It had been recommended for PCI compliance that I filter incoming traffic to UDP port 5353 please can someone advise what are the steps to do this?

I am currently using Centos 5.7 64 bit.

share|improve this question
up vote 8 down vote accepted

How to do what you asked:
With CentOS your firewall is controlled by IPTables / netfilter. Although you could add a rule to block UDP port 5353 traffic with (and traditional state rules):

iptables -A INPUT -p udp -m udp --dport 5353 -m state --state NEW -j DROP

Why you shouldn't do what you asked:
However, I believe that PCI compliance requires that your firewalls have default deny policies, meaning you should be dropping all traffic that you do not allow by specific rules and therefore should not need a specific rule like the one above. You would do this in IPTables by having DROP be the default rule or by adding a DROP rule at the bottom of your firewall. Also, this filtering should probably be happening already on a firewall not a server. If CentOS is your firewall this rules will be on the FORWARD chains, not the INPUT chains.

You probably want outside help:
Judging by level of your question, and complexity of implementing full PCI compliance, I sense you are a bit over your head here. That doesn't make you a bad person or bad at your job. However, just like you are asking for help for specifics here (a great thing to do, props as well for not leaving out that this is for PCI compliance) I recommend you get more help from a consultant on PCI implementation as project on the whole. If after thinking about this for a while you feel this is true, you are actually doing your job as best as you can by admitting that seeking outside help is best for the company.

share|improve this answer
I would seriously consider using the REJECT target wherever possible. Just dropping packets is Bad(tm) unless you know you can't get out a meaningful reply anyway. – the-wabbit Dec 16 '11 at 14:40
thanks for taking the time to write such a good post! Much appreciated I've got quite a few thiigs to go and think about :) – Dino Dec 16 '11 at 15:22

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.