Dotaz: iptables & stream

[maross]

Potreboval by som poradit ako spojazdnit TV live vysielanie. Stanice su za iptables firewallom (+NAT) a squidom. Cez tcpdump som zistil, ze klient sa pripaja na port 1935, co mi potvrdil aj poskytovatel vysielania. Ine porty podla jeho slov nie je treba mat otvorene, jedine tie, ktore su smeruju z 1935 na firewall (to podla mna by malo byt pokryte stavmi ESTABLISHED,RELATED). Cez logy som naozaj zistil, ze klient sa pripaja na vzdialeny stroj na port 1935. Pripadne dalsie pokusy vzdialeneho stroja pripojit sa na nejaky port na firewalli som z logov nezistil. Radio streamy mi vsak funguju v poriadku, len tieto video nie.

Odpovědi

[NN]

Zkus pouzit tcpdump a odchytit si to na zivem provozu..

NN

[maross]

Dump zo stroja, kde to funguje (ina siet, ine pravidla, ...).

  78293 93.637464   moja_ip          195.168.10.74         TCP      49628 > http [ACK] Seq=1018 Ack=10698 Win=65700 Len=0
  78294 93.639700   moja_ip          195.168.10.74         TCP      49628 > http [FIN, ACK] Seq=1018 Ack=10698 Win=65700 Len=0
  78295 93.641746   195.168.10.74         moja_ip          TCP      http > 49628 [ACK] Seq=10698 Ack=1019 Win=7936 Len=0
  78302 94.113309   moja_ip          195.168.10.72         TCP      49629 > macromedia-fcs [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=2
  78303 94.115053   195.168.10.72         moja_ip          TCP      macromedia-fcs > 49629 [SYN, ACK] Seq=0 Ack=1 Win=16384 Len=0 MSS=1460 WS=0
  78304 94.115107   moja_ip          195.168.10.72         TCP      49629 > macromedia-fcs [ACK] Seq=1 Ack=1 Win=65700 Len=0
  78305 94.213852   moja_ip          195.168.10.72         TCP      [TCP segment of a reassembled PDU]
  78306 94.213859   moja_ip          195.168.10.72         TCP      49629 > macromedia-fcs [PSH, ACK] Seq=1461 Ack=1 Win=65700 Len=77[Malformed Packet]
  78307 94.215933   195.168.10.72         moja_ip          TCP      macromedia-fcs > 49629 [ACK] Seq=1 Ack=1538 Win=65535 Len=0
  78308 94.217150   195.168.10.72         moja_ip          TCP      [TCP segment of a reassembled PDU]
  78309 94.217308   195.168.10.72         moja_ip          RTMP     Audio Data[Malformed Packet]
  78310 94.217327   moja_ip          195.168.10.72         TCP      49629 > macromedia-fcs [ACK] Seq=1538 Ack=2921 Win=65700 Len=0
  78311 94.218677   195.168.10.72         moja_ip          TCP      macromedia-fcs > 49629 [PSH, ACK] Seq=2921 Ack=1538 Win=65535 Len=153[Malformed Packet]
  78312 94.219025   moja_ip          195.168.10.72         TCP      [TCP segment of a reassembled PDU]
  78313 94.219029   moja_ip          195.168.10.72         RTMP     Handshake part 3
  78314 94.221082   195.168.10.72         moja_ip          TCP      macromedia-fcs > 49629 [ACK] Seq=3074 Ack=3478 Win=65535 Len=0
  78315 94.228571   195.168.10.72         moja_ip          RTMP     Server BW | Client BW | Ping | Chunk size | Invoke
  78316 94.228684   moja_ip          195.168.10.72         RTMP     Server BW
  78317 94.237197   moja_ip          195.168.10.72         RTMP     Flex Message
  78318 94.237403   moja_ip          195.168.10.72         RTMP     Ping
  78319 94.238561   195.168.10.72         moja_ip          TCP      macromedia-fcs > 49629 [ACK] Seq=3412 Ack=3550 Win=65463 Len=0
  78320 94.239245   195.168.10.72         moja_ip          RTMP     Flex Message
  78321 94.239552   moja_ip          195.168.10.72         RTMP     Flex Message
  78322 94.251423   moja_ip          195.168.10.69         TCP      49631 > http [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=2
  78323 94.252554   195.168.10.69         moja_ip          TCP      http > 49631 [SYN, ACK] Seq=0 Ack=1 Win=5840 Len=0 MSS=1460 WS=6
  78324 94.252597   moja_ip          195.168.10.69         TCP      49631 > http [ACK] Seq=1 Ack=1 Win=65700 Len=0
  78325 94.252759   moja_ip          195.168.10.69         HTTP     GET /grf/tvdoma/menu_aktiv.gif HTTP/1.1 
  78326 94.254318   195.168.10.69         moja_ip          TCP      http > 49631 [ACK] Seq=1 Ack=844 Win=7552 Len=0
  78327 94.256051   195.168.10.69         moja_ip          TCP      [TCP segment of a reassembled PDU]
  78328 94.256250   195.168.10.69         moja_ip          HTTP     HTTP/1.1 200 OK  (GIF89a)
  78329 94.256253   195.168.10.69         moja_ip          TCP      http > 49631 [FIN, ACK] Seq=2468 Ack=844 Win=7552 Len=0
  78330 94.256291   moja_ip          195.168.10.69         TCP      49631 > http [ACK] Seq=844 Ack=2469 Win=65700 Len=0
  78331 94.256723   moja_ip          195.168.10.69         TCP      49631 > http [FIN, ACK] Seq=844 Ack=2469 Win=65700 Len=0
  78332 94.257833   195.168.10.69         moja_ip          TCP      http > 49631 [ACK] Seq=2469 Ack=845 Win=7552 Len=0

[Filip Jirsák]

ESTABLISHED, RELATED se týká jen navázaných spojení, musíte ještě povolit první paket toho spojení.

[maross]

Samozrejme, ze NEW je povolene.

[maross]

Nefunguje to ani na stroji, ktory nejde cez proxy. Prehravanie z archivu funguje, ale live vysielanie nie.