[gentoo-security] problem blocking udp packets with iptables

[Martin Skarda]

Hi All,

I'm trying to protect my dhcp server with some rules within iptables 
against some DoS, and I see all the "hopefully dropped" packages in my log 
target. But the drop doesn't really work: the packages are still going 
through my firewall to my dhcp server.

Here is my simple ruleset:

Chain INPUT (policy DROP 0 packets, 0 bytes)
  pkts bytes target     prot opt in     out     source        destination
     0     0 ACCEPT     all  --  lo     *       0.0.0.0/0     0.0.0.0/0
     0     0 MSK_DHCP   udp  --  *      *       0.0.0.0/0     0.0.0.0/0      udp dpt:67


Chain MSK_DHCP (1 references)
  pkts bytes target     prot opt in     out     source         destination
     0     0 LOG        all  --  *      *       0.0.0.0/0      0.0.0.0/0           LOG flags 0 level 6 prefix '**DHCP-Flood**'
     0     0 DROP       all  --  *      *       0.0.0.0/0      0.0.0.0/0


All my default policies are set to drop.

My testing environment is the ISC dhcp server: net-misc/dhcp-3.0.1-r1 and 
a simple hping.

I see exact the same number of udp packets I sent are reaching the dhcp 
server (shown in my syslog) is also shown in the iptables packet counter.

This behavior was tested on diffrent Kernel Versions: 2.6.15-gentoo-r1 and 
-r7, also on a older vanilla one.

Where is my mistake? I could not believe that this is really a bug?

thanks for a answer,
   Martin

-- 
gentoo-security@g.o mailing list