2

My aim: permit only one iptables related operation on this linux box. That is allow it to be able to tftp download from any server. Here are my rules for that, but they dont seem to work. To emphasise, this is not about my linux box being the server. My box is the client, trying to download from a tftp server.

#iptables -S 
-P INPUT DROP
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-A INPUT -p udp -m state --state ESTABLISHED -j ACCEPT
-A INPUT -p udp -m state --state RELATED -j ACCEPT
-A INPUT -p udp -m udp --dport 69 -m state --state NEW -j ACCEPT

When I try to do a tftp download, it times out.

tftp -g -r /asd.txt  10.0.0.148 

I verified that the tftp download works with these rules

root@kp3:~# iptables -S
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT

Can you please help me correct my rules to allow tftp download?

2
  • You already created a OUTPUT accept chain. Is just a matter of creating the INPUT to related stuff, no matter if udp or tcp - iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
    – user34720
    Jun 20, 2017 at 23:30
  • Tried that, that doesnt work either :( But what are wrong with the rules I presented?
    – Sush
    Jun 20, 2017 at 23:56

1 Answer 1

1

It doesn't really make a lot of sense to allow TFTP "from any server". However, if that's what you want here is what you need

iptables -I INPUT -p udp -j ACCEPT
iptables -I OUTPUT -p udp -j ACCEPT

I don't think you'll like it, though.

Here's an explanation taken from https://en.wikipedia.org/wiki/Trivial_File_Transfer_Protocol#Overview (my bold highlighting)

TFTP uses UDP as its transport protocol. A transfer request is always initiated targeting port 69, but the data transfer ports are chosen independently by the sender and receiver during the transfer initialization. The ports are chosen at random according to the parameters of the networking stack, typically from the range of ephemeral ports.

This is defined more formally in RFC 1350 section 4 paragraph 2.

1
  • This would accept any udp comm on the input interface, which is not really what I'm looking for. The following seems to work, but I dont understand the second rule. Can you explain the second rule if you understand? iptables -A INPUT -p udp -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -t raw -I OUTPUT -j CT -p udp -m udp --dport 69 --helper tftp
    – Sush
    Jun 20, 2017 at 23:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .