Firewall filter rule inconsistency

csohns · Wed Feb 13, 2013 2:23 am

rb1100ahx2 5.22

I'm pushing several hundred concurrent SIP sessions. Every INVITE goes to dport 5060, torch shows this true.

torch1.png

The first rule below follows the same filter as I put into torch, yet the counters do not increment. Everything hits the second rule instead.

/ip firewall filter
add action=accept chain=forward comment="" dst-port=5060 protocol=udp src-address=XXX.XXX.XXX.200 out-interface=ether1-public
add action=accept chain=forward comment="" src-address=XXX.XXX>XXX.200 out-interface=ether1-public

The end game is to track invites using an Layer 7 regex, but I can't do that unless the basics work. Am I blind and missing something obvious?

derr12 · Wed Feb 13, 2013 11:14 pm

You shouldnt need to specify the out interface, try without that. you could also try identifying it via the source port instead of destination as well.

I have better luck identifying via my local IP's instead of publics for some reason too.

csohns · Sat Feb 16, 2013 12:10 am

No luck with or with out the interface nor using source port, which thankfully is static in this case. The WAN and LAN IP are one and the same, it's a routed public internet address. Using the destination address instead of the source along with the afore mentioned combinations also does not work.

tcpdump running directly on the XXX.200 machine verified what torch shows:

# tcpdump -i eth1 -n -nn -N -s 0 src XXX.XXX.XXX.200 and udp dst port 5060
15:04:45.286216 IP XXX.XXX.XXX.200.5060 > XXX.XXX.XXX.27.5060: SIP, length: 424
15:04:46.444211 IP XXX.XXX.XXX.200.5060 > XXX.XXX.XXX.44.5060: SIP, length: 436
15:04:47.075953 IP XXX.XXX.XXX.200.5060 > XXX.XXX.XXX.44.5060: SIP, length: 467
15:04:48.926155 IP XXX.XXX.XXX.200.5060 > XXX.XXX.XXX.44.5060: SIP, length: 467
15:04:50.907552 IP XXX.XXX.XXX.200.5060 > XXX.XXX.XXX.44.5060: SIP, length: 803
15:04:53.230850 IP XXX.XXX.XXX.200.5060 > XXX.XXX.XXX.44.5060: SIP, length: 803
15:04:55.991327 IP XXX.XXX.XXX.200.5060 > XXX.XXX.XXX.44.5060: SIP, length: 436
15:04:59.211580 IP XXX.XXX.XXX.200.5060 > XXX.XXX.XXX.44.5060: SIP, length: 467
15:05:05.039716 IP XXX.XXX.XXX.200.5060 > XXX.XXX.XXX.44.5060: SIP, length: 803

I'm at a loss as to why the MT fw isn't catching it. Over the past several days since my initial post, several thousand packets have hit the rule, but it's definitely not all of them. Only 3 have hit it over the past hour, when it should be 1 every could seconds.

Firewall filter rule inconsistency

Firewall filter rule inconsistency

Re: Firewall filter rule inconsistency

Re: Firewall filter rule inconsistency

Who is online