Re: SNMP Informs sent from snmpd do not work if firewall is enabled on the machine
Dattaram Porob <[email protected]>
| Newsgroups | gmane.network.net-snmp.user |
|---|---|
| Message-ID | <[email protected]> |
Dave, Even if we do assume that the receivers are listening on 162, the rules about specifying source port as 162 will not work because the ack for the Inform request is sent by the receiver from a random port again (and not 162) :(. I tested using 'MGSoft MIB Browser' and it behaves this way; not sure whether all SNMP receivers behave in the same fashion. Any other suggestions ? -Datta. On Tue, Jun 7, 2011 at 9:38 AM, Dattaram Porob <[email protected]> wrote: > Thanks Dave. Will check the feasibility of implementing these suggestions. > > On Mon, Jun 6, 2011 at 7:27 PM, Dave Shield <[email protected]> wrote: >> On 6 June 2011 14:07, Dattaram Porob <[email protected]> wrote: >>> Good suggestion, but then our application supports dynamic addition of >>> trap receivers. >> >> Do the receivers all listen on the standard port? (i.e. 162) >> Are they all on particular subnets? (e.g 10.x.y.z) >> >> >>> So, we would have to modfy iptables rules also >>> dynamically; which does not sound like a good idea to me :( >> >> You could try using a somewhat looser firewall rule >> e.g. >> -A INPUT -p udp --sport 162 -s 10.0.0.0/8 -j ACCEPT >> >> Or possibly a handful of such rules, if you'll have trap >> receivers on a number of defined subnets. >> >> If necessary, you could relax the source IP address completely, >> and allow UDP traffic from port 162 on *any* machine >> >> -A INPUT -p udp --sport 162 -j ACCEPT >> >> >> As with much security, you're looking for a balance between >> locking things down, and keeping things usable! >> >> Dave >> > ------------------------------------------------------------------------------ EditLive Enterprise is the world's most technically advanced content authoring tool. Experience the power of Track Changes, Inline Image Editing and ensure content is compliant with Accessibility Checking. http://p.sf.net/sfu/ephox-dev2dev _______________________________________________ Net-snmp-users mailing list [email protected] Please see the following page to unsubscribe or change other options: https://lists.sourceforge.net/lists/listinfo/net-snmp-users