Subject: Re: SCTP through iptables/netfilter firewall

From: [email-masked]
Date: Thu, 11 Oct 2007 17:10:09 +0000

OK. I'll put the posting there as well.

When I use this sctp_test as the stream generator and capture packets (with my 
firewall down) it does the 4-way handshake with INIT, INIT_ACK, COOKIE_ECHO and 
COOKIE_ACK as the sctp chunk-types. Then, a long sequence of DATA and SACK 
chunk-types.

That, combined with this from the iptables website, is why I use that in the 
iptables ruleset:

http://security.maruhn.com/iptables-tutorial/x5796.html#SCTPMATCHES

--
Bruce Rosenthal
Chief Architect, TranStrophe
Turning Information and Technology Into Business Opportunities

505 521 4879
510 432 7912

 -------------- Original message ----------------------
From: Michael Tuexen <[email-masked]>
> Bruce,
> 
> possibly you might want to ask on the lksctp dev list...
> 
> I'm not sure what
> --chunk-types any INIT,INIT_ACK,COOKIE_ECHO,COOKIE_ACK,DATA,SACK
> means? Why don't you allow HB, HB-ACK and the SHUTDOWN, SHUTDOWN-ACK,
> SHUTDOWN-COMPLETE and ABORT...
> 
> Best regards
> Michael
> 
> On Oct 11, 2007, at 6:37 PM, [email-masked] wrote:
> 
> > Anyone set-up any testing and/or deployment of sctp going through an
> > iptables/netfilter based firewall?
> >
> > That is what I am working on right now but my iptables ruleset  
> > doesn't seem to
> > be working.
> >
> > The ruleset I'm working with is:
> >
> > -A fWeb2Trust -p sctp --sport 9711 --dport 9712 --chunk-types any
> > INIT,INIT_ACK,COOKIE_ECHO,COOKIE_ACK,DATA,SACK -j ACCEPT
> >
> > -A fTrust2Web -p sctp --sport 9712 --dport 9711 --chunk-types any
> > INIT,INIT_ACK,COOKIE_ECHO,COOKIE_ACK,DATA,SACK -j ACCEPT
> >
> > With this in my iptables config and firewall up the firewall is  
> > still dropping
> > all the incoming packets.
> >
> > BTW, for this I am using lksctp's sctp_test utility with the "Web"  
> > host running
> > as a client and the "Trust host running as the server in listen  
> > mode. The firewall host is
> > being run as a gateway/router between the "Web" address space and  
> > the "Trusted"
> > address space.
> >
> > --
> > Bruce Rosenthal
> > Chief Architect, TranStrophe
> > Turning Information and Technology Into Business Opportunities
> >
> > 505 521 4879
> > 510 432 7912
> >