iptables rule needed for DHCP client?

ataraxia · 2010-03-16 02:21:29

For a long time I've had a rule in my iptables ruleset which explicitly allows replies from DHCP servers:

-A INPUT -p udp -m udp --sport 67 --dport 68 -j ACCEPT

Now I'm wondering if I actually need this. I don't filter any outgoing packets and I do have the usual "accept related and established packets" rule before this one. DHCP is really odd and exposes some edge-cases in network setup. In this case, there will be times when I don't have an IP (fresh start for an interface), or when I ask to renew a lease from one DHCP server but get a reply from a totally different one (yeah, our network is weird). I wonder if netfilter is smart enough to see those replies as "established" or "related". Does anybody know for sure? Do you use DHCP and iptables, without such a rule?

Xyne · 2010-03-16 02:32:58

As I understand it, DHCP servers are queried by broadcast so I would expect replies to be considered related or established. I would just remove that rule and see if it works if I were you.

dunz0r · 2010-03-16 09:21:58

I use a dhcp server and I don't use a special dhcp-rule.

ataraxia · 2010-03-16 13:50:30

I took the time to test various DHCP scenarios and found that indeed, it doesn't look like I need this rule. I originally started using it because I did need such a rule with ipfw on OS X - it would block the replies since it didn't know how to deal well with situations where you have to transmit with a 0.0.0.0 source IP.

Arch Linux

#1 2010-03-16 02:21:29

iptables rule needed for DHCP client?

#2 2010-03-16 02:32:58

Re: iptables rule needed for DHCP client?

#3 2010-03-16 09:21:58

Re: iptables rule needed for DHCP client?

#4 2010-03-16 13:50:30

Re: iptables rule needed for DHCP client?

Board footer