[Ferm] Help with helpers

Kiss Gabor (Bitman) kissg at ssg.ki.iif.hu
Fri Nov 18 18:30:20 CET 2011


Dear folks,

I try to enable TFTP traffic on a server.
I searched Google for hours without easy success.
Meanwhile several questions arised.

1. I found that ip_conntrack_tftp kernel module must be loaded.
Should I load it manually, or ferm can do it somehow?

2. This config finally works:

domain ip {     
    table filter {

        chain INPUT {
            policy DROP;
            interface lo ACCEPT;
            mod state state INVALID DROP;
            mod state state (ESTABLISHED RELATED) ACCEPT;

            saddr ($LOCALNET) proto udp dport tftp {
                NOP mod helper helper tftp;
                ACCEPT;
            }
        } # Chain INPUT
    }
}

However I don't understand what happens. :-)
NOP can be replaced with ACCEPT.
The second ACCEPT cannot be omitted.
Why isn't a simple "ACCEPT mod helper helper tftp" enough?

Gabor


More information about the Ferm mailing list