[Bug 814] New: rpfilter blocks broadcast packets

bugzilla-daemon at netfilter.org bugzilla-daemon at netfilter.org
Sun Mar 24 04:50:29 CET 2013


           Summary: rpfilter blocks broadcast packets
           Product: netfilter/iptables
           Version: unspecified
          Platform: x86_64
        OS/Version: Gentoo
            Status: NEW
          Severity: normal
          Priority: P5
         Component: ip_tables (kernel)
        AssignedTo: netfilter-buglog at lists.netfilter.org
        ReportedBy: powerman-asdf at ya.ru
   Estimated Hours: 0.0

Here is my interface:
# ip addr show br.qemu
10: br.qemu: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP 
    link/ether 02:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff
    inet scope global br.qemu

Here is rules:
# iptables -A PREROUTING -t raw -i br.qemu -m rpfilter -j RETURN
# iptables -A PREROUTING -t raw -j LOG --log-level 7 --log-prefix "antispoof: "

Here is example of blocked packet (samba/netbios announce, I suppose):
kern.debug: antispoof: IN=br.qemu OUT= MAC= SRC= DST=
LEN=248 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=138 DPT=138 LEN=228

Also I notice `ping -b` is also blocked:
kern.debug: antispoof: IN=br.qemu OUT= MAC= SRC= DST=
LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=ICMP TYPE=8 CODE=0 ID=22024

So, looks like rpfilter block broadcast packets with correct source IP.
I've no idea is this a bug, but if it's not a bug, then how to allow broadcast
packets without replacing -m rpfilter with manual rule like -s

Configure bugmail: http://bugzilla.netfilter.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.

More information about the netfilter-buglog mailing list