This may look like a duplicate question but I did my share of searching, but could not find any solution.
I have created a tftp server, this server when accessed from a local tftp client, over a loopback gets and puts the file just fine.
When I try to access the server through an external client, The request times out. The connection is established. I can see the connection as connected in the tftp client, no issues there. The File transfer does not start.
The client is connected directly to the HOST via a ethernet cable, I have created a 2 Device LAN. pings work between them.
I initially thought this to be a firewall issue, now I have disabled the firewall, allowed INPUT and OUTPUT on the configured port 69 in the iptables. also udp is allowed on port 69.
I am also Not running multiple instances of the tftpd-hpa server , it is running as a daemon, and netstat -aup has only one tftp server running.
The clients are giving proper requests, I can see them in wireshark, but nothing goes out in response.
and the failure is always a TIMEOUT.
**firewall disabled**
**ports allow connection **
**file transfer fails**
** outgoing tftp request as a client to other tftp servers is alos blocked **
Update2:
I was not really sure about the Firewall thing, as this laptop was issued by my employer and I am skeptical that they wont allow the firewall to be disabled. reading the /var/log/syslog did not give any hints so tried looking at the kernel prints as to whether any kmodules were doing anything fishy, I see these ones.
[10989.915231] FIREWALL: IN=eth1 OUT= MAC=50:7b:9d:f9:44:5d:68:9e:19:99:9e:e4:08:00 SRC=10.42.0.89 DST=10.42.0.1 LEN=65 TOS=0x00 PREC=0x00 TTL=255 ID=117 DF PROTO=UDP SPT=2495 DPT=69 LEN=45
The SRC , DESTT , DPT , PROTO the MAC Address all match my tftp client.
I cannot really tell, what is happening here, so if anyone can give me hints to look for some logs or something else, It would be really helpful.
after this I installed gufw to manage the firewall and allowed all incoming and outgoing traffic. I still get timeouts, and this is what I now see on syslog.
Sep 5 16:16:01 arun-TP kernel: [13836.201853] [UFW AUDIT] IN= OUT=eth1 SRC=10.42.0.1 DST=10.42.0.255 LEN=184 TOS=0x00 PREC=0x00 TTL=64 ID=12630 DF PROTO=UDP SPT=17500 DPT=17500 LEN=164
Sep 5 16:16:01 arun-TP kernel: [13836.201870] [UFW ALLOW] IN= OUT=eth1 SRC=10.42.0.1 DST=10.42.0.255 LEN=184 TOS=0x00 PREC=0x00 TTL=64 ID=12630 DF PROTO=UDP SPT=17500 DPT=17500 LEN=164
This time the DST does not make sense, The client is at 10.42.0.89 and not 10.42.0.255.
Update1:
/etc/default/tftpd-hpa
TFTP_USERNAME="tftp"
TFTP_DIRECTORY="/tftpboot"
TFTP_ADDRESS="0.0.0.0:69"
TFTP_OPTIONS="--secure --create -s"
RUN_DAEMON="YES"
ls -lrt /
drwxr-xr-x 2 tftp nogroup 4096 Sep 5 03:30 tftpboot
netstat -aup
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
udp 0 0 *:mdns *:* 739/avahi-daemon: r
udp 0 0 *:50694 *:* 2514/rpc.mountd
udp 0 0 *:55107 *:* 2514/rpc.mountd
udp 0 0 *:nfs *:* -
udp 0 0 *:3471 *:* 8567/dhclient
udp 0 0 *:56776 *:* 739/avahi-daemon: r
udp 0 0 10.42.0.1:domain *:* 5403/dnsmasq
udp 0 0 127.0.1.1:domain *:* 3025/dnsmasq
udp 0 0 *:bootps *:* 5403/dnsmasq
udp 0 0 *:bootpc *:* 8567/dhclient
udp 0 0 *:tftp *:* 4316/in.tftpd
udp 0 0 *:sunrpc *:* 966/rpcbind
udp 0 0 *:ipp *:* 1476/cups-browsed
udp 0 0 *:707 *:* 966/rpcbind
udp 0 0 *:33526 *:* 2514/rpc.mountd
udp 0 0 *:49935 *:* -
udp 0 0 localhost:796 *:* 1044/rpc.statd
udp 0 0 *:54194 *:* 1044/rpc.statd
udp 0 0 *:17500 *:* 3785/dropbox
udp6 0 0 [::]:mdns [::]:* 739/avahi-daemon: r
udp6 0 0 [::]:42779 [::]:* -
udp6 0 0 [::]:59279 [::]:* 1044/rpc.statd
udp6 0 0 [::]:nfs [::]:* -
udp6 0 0 [::]:60007 [::]:* 2514/rpc.mountd
udp6 0 0 [::]:52311 [::]:* 2254/BESClient
udp6 0 0 [::]:11656 [::]:* 8567/dhclient
udp6 0 0 [::]:sunrpc [::]:* 966/rpcbind
udp6 0 0 [::]:45289 [::]:* 739/avahi-daemon: r
udp6 0 0 [::]:57589 [::]:* 2514/rpc.mountd
udp6 0 0 [::]:707 [::]:* 966/rpcbind
udp6 0 0 [::]:37709 [::]:* 2514/rpc.mountd
no tftp configuration file in /etc/xinetd.d/
Firewall is disabled. ufw status = inactive
iptables -L -v
Chain INPUT (policy DROP 0 packets, 0 bytes) pkts bytes target prot opt in out source destination
2 656 ACCEPT udp -- eth1 any anywhere anywhere udp dpt:bootps
0 0 ACCEPT tcp -- eth1 any anywhere anywhere tcp dpt:bootps
0 0 ACCEPT udp -- eth1 any anywhere anywhere udp dpt:domain
0 0 ACCEPT tcp -- eth1 any anywhere anywhere tcp dpt:domain
36569 3800K ACCEPT all -- lo any anywhere anywhere
30392 20M ACCEPT tcp -- any any anywhere anywhere state RELATED,ESTABLISHED
2704 679K ACCEPT udp -- any any anywhere anywhere state RELATED,ESTABLISHED
0 0 ACCEPT 254 -- ipsec+ any anywhere anywhere
0 0 ACCEPT esp -- any any anywhere anywhere
0 0 ACCEPT ah -- any any anywhere anywhere
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:isakmp
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:ssh
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:cfengine
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:5900
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:5901
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:12080
0 0 REJECT tcp -- any any anywhere anywhere tcp dpt:auth reject-with icmp-port-unreachable
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:https
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:5656
0 0 ACCEPT udp -- any any anywhere anywhere udp dpts:5004:5005
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpts:5004:5005
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:20830
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:20830
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpts:sip:5062
0 0 ACCEPT udp -- any any anywhere anywhere udp dpts:sip:5062
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:21100
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:2001
0 0 ACCEPT gre -- any any anywhere anywhere
0 0 ACCEPT icmp -- any any anywhere anywhere icmp destination-unreachable
0 0 ACCEPT icmp -- any any anywhere anywhere icmp source-quench
689 56460 ACCEPT icmp -- any any anywhere anywhere icmp time-exceeded
0 0 ACCEPT icmp -- any any anywhere anywhere icmp parameter-problem
0 0 ACCEPT icmp -- any any anywhere anywhere icmp router-advertisement
0 0 ACCEPT icmp -- any any anywhere anywhere icmp echo-request
13 832 ACCEPT icmp -- any any anywhere anywhere icmp echo-reply
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:tproxy
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:1533
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpts:30000:30005
0 0 DROP tcp -- any any anywhere anywhere tcp dpts:bootps:bootpc
6 1968 DROP udp -- any any anywhere anywhere udp dpts:bootps:bootpc
0 0 DROP tcp -- any any anywhere anywhere tcp dpt:netbios-ns
0 0 DROP udp -- any any anywhere anywhere udp dpt:netbios-ns
0 0 DROP tcp -- any any anywhere anywhere tcp dpt:netbios-dgm
0 0 DROP udp -- any any anywhere anywhere udp dpt:netbios-dgm
0 0 DROP tcp -- any any anywhere anywhere tcp dpt:netbios-ssn
0 0 DROP udp -- any any anywhere anywhere udp dpt:netbios-ssn
0 0 DROP tcp -- any any anywhere anywhere tcp dpts:tcpmux:ftp-data
0 0 DROP tcp -- any any anywhere anywhere tcp dpt:sunrpc
0 0 DROP tcp -- any any anywhere anywhere tcp dpts:snmp:snmp-trap
0 0 DROP tcp -- any any anywhere anywhere tcp dpt:520
0 0 DROP tcp -- any any anywhere anywhere tcp dpts:6348:6349
0 0 DROP tcp -- any any anywhere anywhere tcp dpts:6345:gnutella-rtr
75 3256 LOG tcp -- any any anywhere anywhere limit: avg 3/min burst 5 LOG level debug prefix "FIREWALL: "
1459 263K LOG udp -- any any anywhere anywhere limit: avg 3/min burst 5 LOG level debug prefix "FIREWALL: "
3347 568K DROP all -- any any anywhere anywhere
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:tftp state NEW,ESTABLISHED
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:69 state NEW,ESTABLISHED
Chain FORWARD (policy DROP 0 packets, 0 bytes) pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- any eth1 anywhere 10.42.0.0/24 state RELATED,ESTABLISHED
0 0 ACCEPT all -- eth1 any 10.42.0.0/24 anywhere
0 0 ACCEPT all -- eth1 eth1 anywhere anywhere
0 0 REJECT all -- any eth1 anywhere anywhere reject-with icmp-port-unreachable
0 0 REJECT all -- eth1 any anywhere anywhere reject-with icmp-port-unreachable
Chain OUTPUT (policy ACCEPT 68593 packets, 6962K bytes) pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- any any anywhere anywhere tcp dpt:69 state NEW,ESTABLISHED
1 45 ACCEPT udp -- any any anywhere anywhere udp dpt:tftp state NEW,ESTABLISHED
Outgoing tftp requests as a client are also blocked. my IP is 192,168.0.5 tried connecting to 192.168.0.2
tftp 192.168.0.2
tftp> verbose on
Verbose mode on.
tftp> status
Connected to 192.168.0.2.
Mode: netascii Verbose: on Tracing: off Literal: off
Rexmt-interval: 5 seconds, Max-timeout: 25 seconds
tftp> put hello
putting hello to 192.168.0.2:hello [netascii]
Transfer timed out.
can there be something wrong with my Router? Is there any settings that I need to take care of, but this problem is there even when I connect the client directly to the server using an ethernet cable. I tired a BeagleBone Black, a MAcbook and my Android Phone as a tftp clients raising request to the server.
Client : 10.42.0.89 (BeagleBlack, at u-boot)
Server : 10.42.0.1
I used wireshark to sniff on the ethernet packets now.
ARP:
32 927.886269000 10.42.0.89 Broadcast ARP 60 Who has 10.42.0.1? Tell 10.42.0.89
33 927.886320000 50:7b:9d:f9:44:5d 10.42.0.89 ARP 42 10.42.0.1 is at 50:7b:9d:f9:44:5d
after this , I see only this initiating from the client and nothing goes out.
36 932.887008000 10.42.0.89 10.42.0.1 TFTP 79 Read Request, File: hello, Transfer type: octet, timeout\000=5\000, blksize\000=1468\000
Best Answer
This part of firewall configuration shows you how all packets will be dropped and then tftp packets will be allowed.
Move drop all and logs rules after tftp allow rules.