1

I'm trying to run a simple Debian server, and I'm using iptables to set up the firewall. I'm aware that most TCP connections migrate ports once they are established, so I've included:

-A INPUT -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT

However after experimenting with:

-A INPUT -j LOG

I've noticed that once these TCP connections migrate, they mysteriously become udp. I tried adding:

-A INPUT -p udp -j ACCEPT

And suddenly I can get responses from curl, docker pull, and apt update. Why does this happen, and is there any way to deal with this other than just leaving all udp ports open? Can udp packets be RELATED or ESTABLISHED?

2 Answers 2

2

If you want to find out what kind of traffic is being blocked, you can use tcpdump to see all the traffic, including what is being blocked.

Without knowing what is being blocked, I think it is likely the DNS traffic is blocked. DNS traffic can either use TCP or UDP. In the future, this will happen even more with HTTP3, that also uses UDP. Curl does not use HTTP3 yet by default, so that would not explain the difference you're seeing however.

3
  • Unfortunately, what was being blocked was a udp response on an arbitrary port. I'm pretty green with iptables, and I didn't realize that traffic to a udp port could be considered RELATED to an established tcp connection. I was using curl google.com as a test, and it seems like a lot of these interweb services will use the tcp connection for metadata, but send the requested data back on an arbitrary udp port (35k in my case). The short version is that -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT was the winner of the chicken dinner.
    – FIREBAAT
    Sep 16, 2022 at 13:06
  • @A.B I don't know much about tcpdump. I just set up a rule to log blocked packets and rolled from there. You got a good resource for tcpdump?
    – FIREBAAT
    Sep 21, 2022 at 23:11
  • opensource.com/article/18/10/introduction-tcpdump is a good article on the basics I think.
    – Gijs
    Sep 23, 2022 at 7:05
0

udp packets can be RELATED,ESTABLISHED! I replaced the first line with the second line, and I can get images from dockerhub, get a response from curl, and apt update!

-A INPUT -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
3
  • @A.B I thought what qualified packets/connections as RELATED was that the socket was opened by the same process (or some child process thereof) that opened the original port?
    – FIREBAAT
    Sep 21, 2022 at 23:08
  • RELATED: The packet is starting a new connection, but is associated with an existing connection, such as an FTP data transfer or an ICMP error. I must not be understanding something; because, that sounds a lot like the UDP guys I get after I run a curl.
    – FIREBAAT
    Sep 21, 2022 at 23:16
  • I wanted to be helpful but I realize I just added confusion. i'm removing my comments.
    – A.B
    Sep 21, 2022 at 23:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .