You are not logged in.
Pages: 1
I'm trying to PXE boot my desktop, everthing is setup but firewall is blocking the TFTP connection.
CONNECTION BLOCKED [OUT] : IN= OUT=eno1 SRC=192.168.0.1 DST=192.168.0.126 LEN=42 TOS=0x00 PREC=0x00 TTL=64 ID=48386 PROTO=UDP SPT=46921 DPT=2074 LEN=22
DHCP/TFTP server has the IP = 192.168.0.1
Desktop Client has the IP = 192.168.0.126 ( Received via DHCP )
Firewall allows the incoming connection at port 69 (TFTP Server port) but it's not allowing the related outgoing connection as stated by the firewall rules (-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT).
iptables.rules
# Generated by iptables-save v1.8.4 on Sat Apr 4 19:26:56 2020
*nat
:PREROUTING ACCEPT [11:1667]
:INPUT ACCEPT [3:1212]
:OUTPUT ACCEPT [13:1154]
:POSTROUTING ACCEPT [10:1025]
COMMIT
# Completed on Sat Apr 4 19:26:56 2020
# Generated by iptables-save v1.8.4 on Sat Apr 4 19:26:56 2020
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
:IN-BLOCKED-LOG - [0:0]
:OUT-BLOCKED-LOG - [0:0]
:PRIVATE-OUT - [0:0]
:TCP-IN - [0:0]
:TCP-OUT - [0:0]
:UDP-IN - [0:0]
:UDP-OUT - [0:0]
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -m comment --comment "Loopback Interface" -j ACCEPT
-A INPUT -m conntrack --ctstate INVALID -j DROP
-A INPUT -p icmp -m icmp --icmp-type 8 -m conntrack --ctstate NEW -j ACCEPT
-A INPUT -p udp -m conntrack --ctstate NEW -j UDP-IN
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m conntrack --ctstate NEW -j TCP-IN
-A INPUT -j LOG --log-prefix "CONNECTION BLOCKED [IN] : " --log-level 6
-A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable
-A INPUT -p tcp -j REJECT --reject-with tcp-reset
-A INPUT -j REJECT --reject-with icmp-proto-unreachable
-A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o lo -m comment --comment "Loopback Interface" -j ACCEPT
-A OUTPUT -p icmp -m icmp --icmp-type 8 -m conntrack --ctstate NEW -j ACCEPT
-A OUTPUT -d 192.168.0.0/16 -m comment --comment "Private Network" -j PRIVATE-OUT
-A OUTPUT -d 255.255.255.255/32 -p udp -m comment --comment "Limited Broadcast" -j ACCEPT
-A OUTPUT -p udp -m conntrack --ctstate NEW -j UDP-OUT
-A OUTPUT -p tcp -m conntrack --ctstate NEW -j TCP-OUT
-A OUTPUT -m comment --comment LOG -j OUT-BLOCKED-LOG
-A IN-BLOCKED-LOG -m limit --limit 1/min -j LOG --log-prefix "CONNECTION BLOCKED [IN] : " --log-level 6
-A IN-BLOCKED-LOG -j DROP
-A OUT-BLOCKED-LOG -m limit --limit 1/min -j LOG --log-prefix "CONNECTION BLOCKED [OUT] : " --log-level 6
-A OUT-BLOCKED-LOG -j REJECT --reject-with icmp-port-unreachable
-A PRIVATE-OUT -d 192.168.0.0/16 -p udp -m udp --dport 53 -m comment --comment "DNS Request" -j ACCEPT
-A PRIVATE-OUT -d 192.168.0.0/16 -p udp -m udp --sport 53 -m comment --comment "DNS Response" -j ACCEPT
-A PRIVATE-OUT -d 192.168.0.0/16 -p tcp -m multiport --sports 80,8000,8080,443 -m conntrack --ctstate NEW -m comment --comment "Http Response" -j ACCEPT
-A PRIVATE-OUT -d 192.168.0.0/16 -p udp -m udp --dport 67 -m comment --comment "DHCP Request" -j ACCEPT
-A PRIVATE-OUT -d 192.168.0.0/16 -p udp -m udp --sport 67 -m comment --comment "DHCP Response" -j ACCEPT
-A PRIVATE-OUT -d 192.168.0.0/16 -p tcp -m tcp --dport 445 -m comment --comment "SMB over TCP" -j ACCEPT
-A PRIVATE-OUT -d 192.168.0.0/16 -m comment --comment LOG -j OUT-BLOCKED-LOG
-A TCP-IN -s 192.168.0.0/16 -p tcp -m multiport --dports 80,8000,8080,443 -m comment --comment "HTTP Request" -j ACCEPT
-A TCP-OUT -p tcp -m multiport --dports 80,8080,443 -m comment --comment Webserver -j ACCEPT
-A TCP-OUT -p tcp -m tcp --dport 143 -m comment --comment IMAP -j ACCEPT
-A TCP-OUT -p tcp -m tcp --dport 110 -m comment --comment POP3 -j ACCEPT
-A TCP-OUT -p tcp -m tcp --dport 25 -m comment --comment SMTP -j ACCEPT
-A TCP-OUT -p tcp -m tcp --dport 993 -m comment --comment "IMAP Secure" -j ACCEPT
-A TCP-OUT -p tcp -m tcp --dport 995 -m comment --comment "POP3 Secure" -j ACCEPT
-A TCP-OUT -p tcp -m tcp --dport 465 -m comment --comment "SMTP Secure" -j ACCEPT
-A TCP-OUT -p tcp -m tcp --dport 9418 -m comment --comment GIT -j ACCEPT
-A TCP-OUT -p tcp -m tcp --dport 22 -m comment --comment "SSH, SFTP" -j ACCEPT
-A TCP-OUT -p tcp -m tcp -m multiport --dports 20,21 -m comment --comment FTP -j ACCEPT
-A TCP-OUT -p tcp -m tcp --dport 2082 -m comment --comment Cpanel -j ACCEPT
-A TCP-OUT -p tcp -m tcp --dport 2083 -m comment --comment "Cpanel Secure" -j ACCEPT
-A UDP-IN -s 192.168.0.0/16 -p udp -m udp --dport 53 -m comment --comment "DNS request" -j ACCEPT
-A UDP-IN -s 192.168.0.0/16 -p udp -m udp --dport 67 -m comment --comment "DHCP Request" -j ACCEPT
-A UDP-IN -s 192.168.0.0/16 -p udp -m udp --sport 67 -m comment --comment "DHCP Response" -j ACCEPT
-A UDP-IN -s 192.168.0.0/16 -p udp -m udp --dport 69 -m comment --comment TFTP -j ACCEPT
-A UDP-IN -d 255.255.255.255/32 -p udp -m comment --comment "Limited Broadcast" -j ACCEPT
-A UDP-OUT -p udp -m udp --dport 53 -m comment --comment "DNS Request" -j ACCEPT
COMMITLast edited by userak (2020-04-04 17:50:52)
A newbie archlinux user ...
Offline
Pages: 1