EPICS Controls Argonne National Laboratory

Experimental Physics and
Industrial Control System

1994  1995  1996  1997  1998  1999  2000  2001  2002  2003  2004  2005  2006  2007  2008  2009  <20102011  2012  2013  2014  2015  2016  2017  2018  2019  2020  2021  2022  2023  2024  Index 1994  1995  1996  1997  1998  1999  2000  2001  2002  2003  2004  2005  2006  2007  2008  2009  <20102011  2012  2013  2014  2015  2016  2017  2018  2019  2020  2021  2022  2023  2024 
<== Date ==> <== Thread ==>

Subject: Re: Firewall (iptables) issues?
From: Eric Norum <[email protected]>
To: "Jeff Hill" <[email protected]>
Cc: [email protected]
Date: Fri, 5 Nov 2010 15:25:10 -0700
I don't understand.  The rules that I presented are for inbound packets.   I explicitly noted that they are sufficient only under the assumption that outbound packets are not filtered.

The first rule
-A INPUT -s 192.168.0.0/22 -p udp --sport 5064 -j ACCEPT
takes care of incoming responses to PV search requests.

The second rule
-A INPUT -s 192.168.0.0/22 -p udp --dport 5065 -j ACCEPT
takes care of incoming beacons.

As far as I can tell, and as far as my empirical tests showed, these are sufficient to allow clients to operate on a firewalled machine.

Could you clarify as to what you feel I've missed?

On Nov 5, 2010, at 3:14 PM, Jeff Hill wrote:

Hi Eric,

If you want channel access clients on a machine to be able to see
replies to broadcast PV search requests you need to permit inbound
UDP packets with source port EPICS_CA_SERVER_PORT (default is 5064)

The server always replies sending to the source address found in the udp
frame containing the client's search request. Since the client library's
UDP socket is locally bound to an ephemeral (dynamically assigned) port
number, and that will be its source address when sending udp search frames,
then it's probably not strictly accurate to say that the firewall can permit
these responses by opening up port EPICS_CA_SERVER_PORT (default is 5064).

I seem to recall that certain stateful firewall implementations remember
the source address of outbound udp frames and, for some amount of time
afterwards, transparently permit udp replies returning to that same
address.


-- 
Eric Norum
[email protected]


Replies:
RE: Firewall (iptables) issues? Jeff Hill
References:
Firewall (iptables) issues? Eric Norum
Re: Firewall (iptables) issues? Ralph Lange
Re: Firewall (iptables) issues? Eric Norum
RE: Firewall (iptables) issues? Jeff Hill

Navigate by Date:
Prev: Re: Firewall (iptables) issues? Till Straumann
Next: RE: Firewall (iptables) issues? Jeff Hill
Index: 1994  1995  1996  1997  1998  1999  2000  2001  2002  2003  2004  2005  2006  2007  2008  2009  <20102011  2012  2013  2014  2015  2016  2017  2018  2019  2020  2021  2022  2023  2024 
Navigate by Thread:
Prev: RE: Firewall (iptables) issues? Jeff Hill
Next: RE: Firewall (iptables) issues? Jeff Hill
Index: 1994  1995  1996  1997  1998  1999  2000  2001  2002  2003  2004  2005  2006  2007  2008  2009  <20102011  2012  2013  2014  2015  2016  2017  2018  2019  2020  2021  2022  2023  2024 
ANJ, 05 Nov 2010 Valid HTML 4.01! · Home · News · About · Base · Modules · Extensions · Distributions · Download ·
· Search · EPICS V4 · IRMIS · Talk · Bugs · Documents · Links · Licensing ·