# Iptables connection tracking replies to UDP broadcasts

## Helix

Hi,

I am having a problem with a certain iptables match that I can't figure out how to implement. Here is the protocol situation:

```

Client  -----------------------------------> 

SRC                                                   DST

192.168.1.2 UDP X                              255.255.255.255 UDP 8777

Client  <----------------------------------- Server

DST                                                   SRC

192.168.1.2 UDP X                              192.168.1.1 UDP 8777

```

The port X is variable. The problem is that the connection tracking on the client does not seem to recognize the reply to belong to the previous broadcast package in spite of the ports matching. So, iptables discards the package. I did manage to "solve" it by adding a rule on the client like ... --sport 8777 -j further_processing, however, this might have adverse side effects since anything accidently ending up in further_processing and not being related to this particular protocol will likely be dropped. So, is there more beautiful way of doing that ? I found the conntrack module but I can't quite figure out if it serves my purpose ...

Thanks in advance,

Helix

----------

## Hu

Could you show the rule you tried without success and explain what you saw that causes you to believe it was ineffective?

Seeing the full rules, as shown by iptables-save might also be helpful.

----------

