3

Based on this answer, blocking port 67 UDP outgoing should be

firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 0 -p udp -m udp --dport=67 -j ACCEPT
firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 1 -j DROP
firewall-cmd --reload

Port 67 UDP is the port a DHCP server uses, so I would like to verify that the port is indeed blocked before I start the DHCP server, so I can experiment with it in a sandbox.

Question

Since it is UDP and below 1024, how can I comfirm it is blocked?

200_success
  • 4,701
  • 1
  • 24
  • 42
Sandra
  • 9,973
  • 37
  • 104
  • 160

3 Answers3

3

You can use a tool like netcat (on the server echo test | nc -u <other IP> 67 and on another machine nc -u -l -p 67, or use Wireshark or similar) and see if the message pops up.

user
  • 154
  • 2
1

I'm pretty sure you could use Nmap's UDP port scan to specify the protocol and port. The syntax is as follows:

$ sudo nmap -sU -p port target
OHackerDoAmor
  • 21
  • 2
1

Port 67 UDP is the port a DHCP server uses, so I would like to verify that the port is indeed closed before I start the dhcp server, so I can experiment with it in a sandbox.

A test DHCP server should be isolated in a VLAN or configured with split scopes that don't overlap existing DHCP ranges. If test and production are in the same broadcast domain, either may get the broadcast which may cause unexpected behavior. See: 2 DHCP servers on one network

Also, you can limit the interfaces dhcpd is listening on to this sandbox net. Without relay agents, it won't see DHCPDISCOVER messages on other nets.

John Mahowald
  • 30,009
  • 1
  • 17
  • 32
  • Are you saying that in order to test if the port is blocked, they should set up an additional VLAN, with its own subnet, configure a DHCP client on that VLAN and see if the client gets an address? That seems like overkill to me. – Centimane Oct 30 '18 at 17:41
  • No. DHCP, being broadcast, can reply where you may not expect it. In addition to port firewalls, consider isolated subnets and limit what interfaces dhcpd listens on. – John Mahowald Oct 31 '18 at 13:30
  • So then are you simply warning about a possible pitfall, rather than suggesting a solution? – Centimane Oct 31 '18 at 14:27