On Wednesday 05 February 2003 22:06, David S. wrote:
> > If I turn off IPfilter the machine turns up on xterms chooser screens but
> > as soon as I start up the firewall
> > it disappears. Even if I free up the command in ipf.conf to enable access
> > for all machines to udp port 177.
> >
> > Does anyone know is there some other port I should enable access to so
> > that my server shows up on chooser screens?
>
I believe the protocol used is XDMCP, and works as follows:
Client sends a udp packet to the subnet broadcast address, on port 177, and
all the servers on the local subnet respond.
I have no idea why this would ever work through a router, unless the router is
forwarding network broadcasts (which is generally a bad thing).
[XCDMP server] ---- [hme0:ipf firewall:hme1]----[X chooser]
You should need something like this:
pass in on hme1 proto udp from <clients> to <broadcast address> port 177
pass in on hme0 proto udp from <server> port 177 to <clients> port > 1023
unfortunately 'keep state' will not work, as the return packet does not match
the packet sent to the broadcast address (the source address is different...
i.e. not the broadcast address).
> Probably 6000, but the easiest way to find out is by logging all
> blocks and looking to see which ones from the X chooser are blocked.
Na, 6000/tcp is used by X, as the display port (for the first X display).
I believe 6000-6063/tcp are reserved for X usage... (anyone out there running
64 X displays on the one machine ?????)
-Antony
*************************************************************************
This e-mail and any attachments may contain confidential or privileged
information. If you are not the intended recipient, please contact the
sender immediately and do not use, store or disclose their contents.
Any views expressed are those of the individual sender and not of Kinetic
Information System Services Limited unless otherwise stated.
www.kinetic.co.uk
