Subject: SCTP through iptables/netfilter firewall

From: [email-masked]
Date: Thu, 11 Oct 2007 16:37:41 +0000

Anyone set-up any testing and/or deployment of sctp going through an 
iptables/netfilter based firewall?

That is what I am working on right now but my iptables ruleset doesn't seem to 
be working.

The ruleset I'm working with is:

-A fWeb2Trust -p sctp --sport 9711 --dport 9712 --chunk-types any 
INIT,INIT_ACK,COOKIE_ECHO,COOKIE_ACK,DATA,SACK -j ACCEPT

-A fTrust2Web -p sctp --sport 9712 --dport 9711 --chunk-types any 
INIT,INIT_ACK,COOKIE_ECHO,COOKIE_ACK,DATA,SACK -j ACCEPT

With this in my iptables config and firewall up the firewall is still dropping 
all the incoming packets.

BTW, for this I am using lksctp's sctp_test utility with the "Web" host running 
as a client and the "Trust host running as the server in listen mode. The firewall host is 
being run as a gateway/router between the "Web" address space and the "Trusted" 
address space.

--
Bruce Rosenthal
Chief Architect, TranStrophe
Turning Information and Technology Into Business Opportunities

505 521 4879
510 432 7912

---

From: Michael Tuexen <[email-masked]>
Date: Thu, 11 Oct 2007 18:59:09 +0200

Bruce,

possibly you might want to ask on the lksctp dev list...

I'm not sure what
--chunk-types any INIT,INIT_ACK,COOKIE_ECHO,COOKIE_ACK,DATA,SACK
means? Why don't you allow HB, HB-ACK and the SHUTDOWN, SHUTDOWN-ACK,
SHUTDOWN-COMPLETE and ABORT...

Best regards
Michael

---

From: Vlad Yasevich <[email-masked]>
Date: Thu, 11 Oct 2007 13:32:44 -0400

> INIT,INIT_ACK,COOKIE_ECHO,COOKIE_ACK,DATA,SACK -j ACCEPT

One of the possible issues is that you need to make sure that the new chains
that you created are actually called and matched.

My guess is that you might need 2 rules like:

 -A INPUT -p sctp -j fWeb2Trust
 -A OUTPU -p sctp -j fTrust2Web

or vise versa... not sure what system these rules really are on.

Also, like Michael stated, you are missing other chunks.  You probably don't want
to restrict chunks they way you do as you'll drop SHUTDOWNS, ABORTS, HEARTBEATS
and other chunk that SCTP may need for good operations.

-vlad