Home / server / Questions / 325652
Accepted
Sandra
Asked: 2011-10-29 02:51:07 +0800 CST

How to make iptables ALLOW rule for multicast?

  • 772

I have two servers that uses ucarp as failover. On each server eth1:1 is reserved for ucarp's keepalive connection.

ucarp uses the destination IP as multicast address 224.0.0.18.

On ucarp master server is eth1:1's IP 192.168.245.2 and on the secondary serve is eth1:1's IP 192.168.245.3.

Question

I would like to make an iptables rule on each server, so these NIC's are not used by anyone by mistake. I.e. drop everything expect for ucarp.

How would such a rule look like for the master server?

I assume something like this?

iptables -P INPUT -i eth1:1 -j DROP
iptables -A INPUT -i eth1:1  ? something with multicast ?  -j ACCEPT
firewall linux iptables failover ucarp

1 Answers

  1. Best Answer
    iptables -A INPUT -i eth1:1 -m pkttype --pkt-type multicast -j ACCEPT

    Make sure that the xt_pkttype module is loaded into the running kernel:

    --- Networking support        
      Networking options  --->
          [*] Network packet filtering framework (Netfilter)  --->
              Core Netfilter Configuration  --->
                  <*>   "pkttype" packet type match support
    • 7