TFTP from another subnet

[sd_read]

Hi Ken;

I posted my previous post before I saw your most recent.

It would appear that your suspicions have been correct all along and I will follow your most recent advice and post on the Smoothwall forums.

Thank you for your help- Steve

[ken_yap]

You could insert an accept all port 69 packets (in both directions) into the pinhole table (no NEW, etc) and see if that works. Unfortunately you will have to use the iptables CLI command to do this.

[ken_yap]

Ok, a bit of searching turned up this:

TFTP through IPCOP or other iptables firewalls « Keystone IT Tech

IPCop is derived from Smoothwall so it should be similar. I think the key module to load is the conntrack_tftp module, since NAT is not involved in going from green to orange DMZ.

Yes, a quick check of IPCop shows that the conntrack_tftp module does exist in netfilter, so you should load it, otherwise the firewall will not be able to let subsequent packets through after the NEW packet has been allowed through.