https://bugzilla.novell.com/show_bug.cgi?id=839292 https://bugzilla.novell.com/show_bug.cgi?id=839292#c Alberto Planas Dominguez changed: What |Removed |Added ---------------------------------------------------------------------------- Status Whiteboard| | GOLD -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=839292 https://bugzilla.novell.com/show_bug.cgi?id=839292#c2 Alien A changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |NEW InfoProvider|alien.www@gmx.com | --- Comment #2 from Alien A 2013-09-27 13:38:23 UTC --- First I was trying to do it with FW_SERVICES_ACCEPT_EXT Then I decided to make my own rules and place them in SuSEfirewall2-custom (in fw_custom_before_port_handling()). But often flooder was able to bypass it. My debug showed that it was accepted by default "--ctstate ESTABLISHED -j ACCEPT" rule. For now I found workaround to delete that rule and add my own with exception: iptables -D INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT iptables -A INPUT -m conntrack --ctstate ESTABLISHED ! --ctorigdstport 5060:5061 -j ACCEPT It works, but I think it would be nice to have option(s) in /etc/sysconfig/SuSEfirewall2 to change or disable that "--ctstate ESTABLISHED -j ACCEPT" By default, any "established" traffic get accepted without any further flood control. That can affect any service, not only ּSIP. I'll attach my whole SuSEfirewall2-custom file. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=839292 https://bugzilla.novell.com/show_bug.cgi?id=839292#c Marcus Meissner changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #560567|application/octet-stream |text/plain mime type| | -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=839292 https://bugzilla.novell.com/show_bug.cgi?id=839292#c5 --- Comment #5 from Alien A 2013-09-27 16:36:30 UTC --- (In reply to comment #4)

the udp parts might be default in the ESTABLISHED chain., but if it is a different session i wonder why they are marked ESTABLISHED at all.

My server initially responds with "403 Forbidden" or something similar. That marks connection as "established" and allows further packets from that source to be accepted by FW, I suppose. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.