On Wed, Jan 04, 2017 at 06:38:30PM +0100, Archimede Pitagorico wrote: > <html><head></head><body><div style="font-family: ...
Um, please don't post HTML to mailing lists. Many of the more helpful people you might encounter are using console-based MUAs, and they won't get to see your fancy fonts and formatting. Also, top- posting is awkward to read. Please trim your quotes and keep them with the relevant reply text ("inline quoting".) > <div>it was a rule in the PREROUTING chain of the raw > table:</div> > > <div>rpfilter --invert -j DROP </div> > > <div>that caused messages incoming from clients to be dropped. And here's another problem: be careful with filtering in the raw table. Filtering should be done in the filter table (which, go figure, may be why they named it "filter".) > <div> </div> > > <div>It is easy to modify the rule to allow dhcp traffic > through, so problem solved.</div> > > <div> </div> > > <div>I have another question however about this:</div> > > <div>> ISC's dhcp server uses a lower-level > network model than dnsmasq, and can work despite > iptables rules to the contrary.</div> > > <div>How can an app bypass the kernel firewall? Can you please > suggest a reference for me to understand better? </div> Well, that's overstating it a bit. ISC dhcpd uses raw sockets, and those are (like tcpdump) seen before the netfilter subsystem. But note, a complete DHCP exchange is "DORA": Discover by the client; Offer by the server; Request by the client; and Ack by the server. With dhcpd only DO are not blockable. RA certainly are. -- http://rob0.nodns4.us/ Offlist GMX mail is seen only if "/dev/rob0" is in the Subject: _______________________________________________ Dnsmasq-discuss mailing list Dnsmasq-discuss@lists.thekelleys.org.uk http://lists.thekelleys.org.uk/mailman/listinfo/dnsmasq-discuss