help with --helper sane
Hi all,
I'm trying to make a usb scanner network available using "saned". The machines involved are both running "saned -a". It works well until I turn on iptables on the machine with the scanner.
If I enable firewalling with port 6566 open the scanner initializes but never proceeds beyond that point.
I tried these:
-A INPUT -p tcp -m tcp --dport 6566 -m conntrack --ctstate NEW -m helper --helper "sane" -j ACCEPT -A INPUT -p udp -m udp --dport 6566 -m conntrack --ctstate NEW -m helper --helper "sane" -j ACCEPT
but that results in "no scanners found".
Using CUPS as an example I did this on both sides and didn't have any luck that way either.
Sorry if I can't better describe this. I've never used a scanner over the net before and netfilter's helpers are new to me. Google finds many references to iptables and sane, but only in the context of sanity, which I am quickly losing ;D
Any helpers?
TIA,
Mike Wright
Quoted 11 lines · Mike Wright
Hi all,
I'm trying to make a usb scanner network available using "saned". The machines involved are both running "saned -a". It works well until I turn on iptables on the machine with the scanner.
If I enable firewalling with port 6566 open the scanner initializes but never proceeds beyond that point.
I tried these:
Review
Quoted 4 lines
(quoted diff) +0
-4-A INPUT -p tcp -m tcp --dport 6566 -m conntrack --ctstate NEW -m helper --helper "sane" -j ACCEPT -A INPUT -p udp -m udp --dport 6566 -m conntrack --ctstate NEW -m helper --helper "sane" -j ACCEPT
That's only accepting the packet that initiates the connection. You'll need to allow subsequent related packets as well. Something like:
-A INPUT -p tcp -m conntrack --ctstate ESTABLISHED -j ACCEPT
I don't know the "sane" protocol, so you might need to add RELATED as well. You'll also need to make sure that you're allowing the packets to return out as well (OUTPUT).
Also, I consider the dport *and* helper match a bit of an overkill. I would just use the dport match, at least until it's working.