From: Michael Prokop <mika@grml.org>
Date: Sat, 25 Nov 2006 20:51:10 +0000 (+0100)
Subject:   * Deactivate Multicast-DNS via iptables, thanks for suggestion -
X-Git-Tag: 0.78
X-Git-Url: http://git.grml.org/?a=commitdiff_plain;h=fa14c03a6ee9cd0ad616ed9e134f26be8397a2c3;hp=1348b5a404740e9f2a4bb99949533d7587b11af7;p=grml-terminalserver.git

  * Deactivate Multicast-DNS via iptables, thanks for suggestion -
    Wolfgang Karall! Mention details about iptables commands also
    when starting up grml-terminalserver.
---

diff --git a/debian/changelog b/debian/changelog
index 48f2d55..ddf8d1b 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,11 @@
+grml-terminalserver (0.78) unstable; urgency=low
+
+  * Deactivate Multicast-DNS via iptables, thanks for suggestion -
+    Wolfgang Karall! Mention details about iptables commands also
+    when starting up grml-terminalserver.
+
+ -- Michael Prokop <mika@grml.org>  Sat, 25 Nov 2006 21:49:59 +0100
+
 grml-terminalserver (0.77) unstable; urgency=low
 
   * Avoid syntax error in dhcpd.conf if values for DNS and Gateway
diff --git a/grml-terminalserver b/grml-terminalserver
index 20bfe29..8ad2ae0 100755
--- a/grml-terminalserver
+++ b/grml-terminalserver
@@ -135,21 +135,30 @@ function runDhcp
 # make sure tcp/113 is rejected
 function runIptables
 {
- # something keeps answering all tftp requests with auth requests (SYN
- # packets to the client tcp/113). Since the PXE client doesn't answer with
- # RST, the auth query has to wait until it times out. Forbidding the
- # terminalserver to send out packets to tcp/113 via iptables _greatly_
- # speeds up the process. But of course the real fix would be to have grml
- # stop sending out auth queries to tftp clients. according to netstat, it
- # is in.tftpd itself sending out the auth queries.
- # Thanks to Marc Haber and Wolfgang Karall for noticing and current fix.
  if [ -x /sbin/iptables ] ; then
-    if iptables -L | grep -q '^REJECT.*tcp-reset' ; then
+    # something keeps answering all tftp requests with auth requests (SYN
+    # packets to the client tcp/113). Since the PXE client doesn't answer with
+    # RST, the auth query has to wait until it times out. Forbidding the
+    # terminalserver to send out packets to tcp/113 via iptables _greatly_
+    # speeds up the process. But of course the real fix would be to have grml
+    # stop sending out auth queries to tftp clients. according to netstat, it
+    # is in.tftpd itself sending out the auth queries.
+    # Thanks to Marc Haber and Wolfgang Karall for noticing and current fix.
+    if iptables -L | grep -q '^REJECT.*tcp dpt:auth reject-with tcp-reset' ; then
        echo "Rule for tcp/113 already present, nothing to be done."
     else
-       echo -n "Rejecting tcp/113 via iptables to speed up speed up booting via PXE: "
+       echo "Rejecting tcp/113 via iptables to speed up booting via PXE, running:"
+       echo -n '* iptables -A OUTPUT -p tcp --dport 113 -j REJECT --reject-with tcp-reset'
        iptables -A OUTPUT -p tcp --dport 113 -j REJECT --reject-with tcp-reset && echo done || echo failed
     fi
+    # deactivate Multicast-DNS
+    if iptables -L | grep -q '^REJECT.*dpt:mdns reject-with icmp-port-unreachable' ; then
+       echo "Rule for udp/5353 already present, nothing to be done."
+    else
+       echo "Rejecting udp/5353 via iptables for deactivating Multicast-DNS, running:"
+       echo -n '* iptables -A OUTPUT -p udp -d 224.0.0.0/8 --dport 5353 -j REJECT'
+       iptables -A OUTPUT -p udp -d 224.0.0.0/8 --dport 5353 -j REJECT && echo done || echo failed
+    fi
  else
     warn "iptables executable not avilable"
  fi