0

Problem : I'm facing to a problem with TFTP server and Cisco 79XX IP phones. When on a local network, everything is working fine, but when the TFTP server is on a public server (and phones inside a private network - behind NAT/firewall), the phones can contact the TFTP on UDP 69 but cannot retreive any file/data (timeout).

Reason : "According to RFC 1350, the server sends to the client (from a random port) DATA TFTP packet. However, firewall rejects this packet because it cannot find the existing connection between the chosen server port and the client’s port in the table of translation."

Possible solution : I need to make TFTP server use port 69 not only to receive requests, but also to send the answers to the clients. "In this case firewall will correctly transmit the answers to the client according to the record from the table of translation." Also, some VoIP providers solved the problem by writing their own TFTP server.

Question : I cannot found any specific option/configuration in linux atftp server which defines the port(s) used for replies to clients. Is there any such option or another free/open source linux TFTP server which can handle this ?

Thanks, CL

0

Your solution should be found in your firewall configuration, not in the TFTP server.

Any firewall worth their salt should be able to recognize the response to the initial TFTP request and can be configured to dynamically track and temporarily allow the return TFTP connection.

I.e. the Linux netfilter has a helper modules nf_conntrack_tftp and nf_nat_tftp which similar to the FTP helper will, after loading, allow the tracking of return TFTP connections.

A Cisco PIX for instance can do same (possibly by default even).

  • Thanks for your response, but in fact, altrough I've triyed to enable these two modules on server side (my bad ...), there is a major inconvenient : we don't have access to all routers/firewalls on clients side (some are SonicWall)... And even if this might be the case, i guess certain routers (D-Link/TP-Link/...) don't support these features :( – Coldlight Feb 6 '14 at 16:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.