0

I have a server that receives its IP address by DHCP. This seems to work and the connectivity is working (at the moment). However, I have not rebooted since installing a new /etc/sysconfig/iptables file so I could lose big upon the next reboot in case DHCP functionality depends on the connections now blocked.

I have noticed that my firewall blocks outgoing UDP DHCP connections like this one:

[22994.373788] Firewall: *UDP_OUT Blocked* IN= OUT=enup0 SRC=$OUR_IP DST=$DHCP_SERVER_IP LEN=328 TOS=0x00 PREC=0x00 TTL=64 ID=53942 DF PROTO=UDP SPT=68 DPT=67 LEN=308 UID=0 GID=0

This is presumably some DHCP client command like the request for a renewal of the DHCP lease?

What happens if I block this outgoing request? If that is DHCP server implementation dependent: Does perhaps an RFC document demand I do not block this?

Related: Do the firewall rules get initialised from /etc/sysconfig/iptables (by iptables.service) before or after the network is brought up during boot?

I wish to block as much as possible otherwise I would just allow it instead of asking here.

Improve this question
3
  • Curious (because such DHCP traffic can't usually be blocked by iptables): Is the main interface of the DHCP client directly enup0, or is there a bridge involved?
    – A.B
    Oct 16, 2021 at 17:23
  • @A.B It's a physical PCIe attached Ethernet port (copper). I do have some VXLAN bridges and virtual interfaces but this is the one and only uplink.
    – Ned64
    Oct 16, 2021 at 17:31
  • Ok. Just for information, some DHCP clients such as ISC's dhclient use AF_PACKET socket (mostly in order to be able to emit source address 0.0.0.0 for DHCP's DISCOVER packets) . AF_PACKET isn't seen by iptables.
    – A.B
    Oct 16, 2021 at 17:44

1 Answer 1

Reset to default
3

The consequence of blocking that access is that your DHCP client will not be able to renew it's IP address lease until it expires.

When the lease expires and the client still cannot reach the DHCP server by unicast, the DHCP client will unconfigure the current IP address, and then will start the DHCP request process from the beginning, using broadcasts so the packets will be addressed 0.0.0.0:68 -> 255.255.255.255:67. Because this violates normal IP addressing rules, on Linux the DHCP client will need to use raw sockets, which won't be blocked by regular iptables filter rules. Unless the network segment has an acute shortage of IP addresses, the DHCP server is likely to reissue your system the same IP address again when it receives the broadcast request.

So, the overall effect will be that the system will still get its IP address, but you might experience a brief but totally unnecessary IP connectivity glitch each time the system's DHCP lease is due to expire.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .