DHCP Firewall Issue

[benningtonr]

I just made a change to my firewall and it looks as follows. Soon after my DHCP checks started failing unless i had the firewall turned off.

# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT

# SSH
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT

# HTTP/HTTPS
-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT

# DHCP
#-A INPUT -p udp --dport 67 -j ACCEPT
#-A INPUT -p udp --dport 68 -j ACCEPT

# SNMP
#-A INPUT -m state --state NEW -m udp -p udp --dport 161 -j ACCEPT
# SNMP Traps
#-A INPUT -m state --state NEW -m udp -p udp --dport 162 -j ACCEPT

# NRPE
#-A INPUT -m state --state NEW -m tcp -p tcp --dport 5666 -j ACCEPT

# NSCA
#-A INPUT -m state --state NEW -m tcp -p tcp --dport 5667 -j ACCEPT
#FTP
-A INPUT -p tcp -m state --state NEW -m tcp --dport 20 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT

-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
~
~
~
"/etc/sysconfig/iptables" 38L, 1155C

[abrist]

As you have statefull rules, you may need to add the statefull rules to the dhcp lines:

Code: Select all

-A INPUT -p udp --dport 67 --state NEW,ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p udp --dport 68 --state NEW,ESTABLISHED,RELATED -j ACCEPT 

Alternatively, you could try enabling dhcp on just your internal interface (replace $INTIF with the the name of your lan interface (eth0, etc)).

Code: Select all

-A INPUT -i $INTIF -p tcp --sport 68 --dport 67 -j ACCEPT
-A INPUT -i $INTIF -p udp --sport 68 --dport 67 -j ACCEPT

[benningtonr]

I have tried running the following with the firewall enabled and it still does not work:

ptables -I INPUT -i eth0 -p udp --dport 67:68 --sport 67:68 -j ACCEPT

[abrist]

hmmm. You may want to enable logging of dropped packets to hunt down why they are getting dropped:
http://www.thegeekstuff.com/2012/08/ipt ... g-packets/