4

I am on Debian Buster.

I have two network devices in my server. Wifi which is connected to the internet, and a ethernet card which is connected to a small intranet at home.

I have installed dnsmasq, which works as DHCP server for the intranet through the Ethernet card.

Other PCs connected to the same ethernet switch get an IP number as defined by dnsmasq. I can transfer files, etc no problems.

If the firewall ufw is enabled, then client PCs do not get IP numbers. As soon I disable de ufw, all the client PC get the IP number.

I allowed ports 53, 67, 68,... I am not sure how many ports I tried from different forums.

Currently, my ufw status is:

:~$ sudo ufw status: Status: active

To Action From

22/tcp ALLOW Anywhere
80/tcp ALLOW Anywhere
443/udp ALLOW Anywhere
DNS ALLOW Anywhere
67/udp ALLOW Anywhere
68/udp ALLOW Anywhere
53 ALLOW Anywhere
22/tcp (v6) ALLOW Anywhere (v6)
80/tcp (v6) ALLOW Anywhere (v6)
443/udp (v6) ALLOW Anywhere (v6)
67/udp (v6) ALLOW Anywhere (v6)
68/udp (v6) ALLOW Anywhere (v6)
53 ALLOW OUT Anywhere

I went over stack forums. They suggested port 67, udp, proto, etc nothing worked

Any idea?

EDIT I run tcpdump -i mydev Then I disable ufw, and the tcp log was:

23:00:18.939873 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 00:11:71:56:18:q6 (oui Unknown), length 286
23:00:21.788245 IP PersonalCloud.local.57586 > all-systems.mcast.net.4448: UDP, length 116 
23:00:21.788333 IP PersonalCloud.local.57586 > 224.0.0.249.4448: UDP, length 116
23:00:21.941823 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 01:11:71:51:18:a6 (oui Unknown), length 286
23:00:22.780809 IP dnsmasq.netbios-dgm > 192.168.2.255.netbios-dgm: UDP, length 219 
23:00:24.192421 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 14:01:6a:1c:1c:we (oui Unknown), length 300  
23:00:24.945175 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 01:11:15:56:18:a6 (oui Unknown), length 286 
23:00:27.211282 IP dnsmasq.17500 > 192.168.2.255.17500: UDP, length 449   
23:00:27.211701 IP dnsmasq.17500 > 192.168.2.255.17500: UDP, length 445 
23:00:28.927026 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 61:51:31:91:e3:4a (oui Unknown), length 300 
23:00:29.127449 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 61:01:61:51:d1:31 (oui Unknown), length 300 
23:00:30.808357 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 61:51:31:91:e1:41 (oui Unknown), length 300 
23:00:33.551227 IP > 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 61:51:31:91:e1:41 (oui Unknown), length 300 
23:00:35.618172 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 61:01:61:51:d1:31 (oui Unknown), length 300 
23:00:37.899922 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 68:51:31:91:e1:41 (oui Unknown), length 300 
23:00:42.752985 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 6a:01:61:51:dc:3e (oui Unknown), length 300 
23:00:46.392675 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 61:51:31:91:e1:41 (oui Unknown), length 300 
23:00:46.405925 IP dnsmasq.bootps > Mac-mini.bootpc: BOOTP/DHCP, Reply, length 300

I just copied-paste from I disabled ufw until I got IP numbers in the MAc-mini PC.

So, what is the port?

Improve this question
3
  • 1
    Suggestions: Double-check firewall with iptables-save; ufw logging medium or high; tcpdump -i eth123 udp port 67 or port 68; dnsmasq logging (you find how what can be logged and how; it's probably in the systemd journal).
    – berndbausch
    Mar 8, 2021 at 23:29
  • normally dnsmasq opens tcp/udp on one port usually something like 53 to localhost and then opens udp on another port usually 67 to the net
    – Jason Croyle
    Mar 9, 2021 at 1:35
  • So, you want me to run tcpdump and see what ports are the client PCs trying to reach? ok, I will try it tonight.
    – daniel_hck
    Mar 9, 2021 at 21:15

1 Answer 1

Reset to default
8 
sudo ufw allow bootps
sudo ufw allow 53/udp
sudo ufw allow 53/tcp
Improve this answer
7
  • 2
    Thanks Oscar! After months of trying to add all ports from different forums, I deleted all my 53, 67, and 68 entries and added yours. It worked immediately! Thanks so much! SOLVED!!
    – daniel_hck
    Mar 10, 2021 at 14:41
  • 3
    The important bit is DHCP does not just communicate using regular IP addresses, but needs to also allow traffic with a destination address 255.255.255.255 out the DHCP server port and into the client port, because the the client's real IP address may not be known yet. ufw allow bootps will handle this automatically as a special case; just allowing UDP ports 67 and 68 will not.
    – telcoM
    Mar 10, 2021 at 16:26
  • 1
    Touche! this was exactly what happened! Thanks, telcoM!
    – daniel_hck
    Mar 10, 2021 at 21:51
  • 1
    @telcoM Could you please explain better your point? So, you said that before assigning an IP to the client, the client might have an unknown IP. If the ufw 67/68 are allowed anywhere, why this is not sufficient? why the need for the magic bootps?
    – daniel_hck
    Mar 12, 2021 at 14:47
  • 3
    When using ufw, the list of allowed ports is incorporated into a longer list of iptables/netfilter firewall rules. Those rules include filtering out traffic that looks invalid or malicious - and broadcasting to 255.255.255.255 without a good reason is obnoxious and could be a denial-of-service. ufw allow bootps "knows" that bootp and its successor DHCP will need a small exemption to those "filter out invalid/malicious traffic" rules. Just allowing a port assumes that the service using the port will be a standard well-behaved one.
    – telcoM
    Mar 12, 2021 at 18:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.