TFTP & pfsense

cjkeeme · Feb 19, 2010, 4:00 AM

I've searched the forums and on Google for a while. Is it correct that my VoIP phones can't update through tftp when they are behind pfsense? I can't get this working and it seems that it is a problem with no solution. Anyone had luck with this?

cjkeeme · Feb 19, 2010, 2:45 PM

This is a little frustrating. I have tried everything and searched everywhere with no solution. One individual suggests the below:

nano /etc/rc.d/rc.network

add these two lines:
modprobe ip_conntrack_tftp
modprobe ip_nat_tftp

Save and exit.

I have no way to test this right now. Does anyone have some reference to how to fix this problem? Thanks.

danswartz · Feb 19, 2010, 2:52 PM

The suggestion they gave you seems to have been for a linux setup :( Do your phones connect to a tftp server visible to anyone on the internet? If so, that is not very secure.

cjkeeme · Feb 19, 2010, 3:17 PM

Do your phones connect to a tftp server visible to anyone on the internet? If so, that is not very secure.

We have taken proper measures to ensure security. I do want to get TFTP working though. Anyone with any thoughts?

Eugene · Feb 21, 2010, 2:43 AM

Technically to allow your IP phones to download from public TFTP server it is enough to open UDP port 69. So if your phone settings allow you specify TFTP server IP you should be fine.
But typical scenario is IP phone gets TFTP server address from DHCP-server. As I know in 1.2.3 DHCP server does not allow you to distribute TFTP server IP address, so the solution would be to use separate DHCP server for your phones.

danswartz · Feb 21, 2010, 5:10 AM

true for 1.2.3 - however i found it a one-line patch to the services.inc file to allow me to set my tftp server address. 2.0 allows this the right way though.

danswartz · Feb 21, 2010, 5:11 AM

also, when you said it didn't work, that didn't really get too specific. do you have any kind of packet trace showing what is going on (if anything?)

wallabybob · Feb 21, 2010, 7:58 PM

@cjkeeme:

. . . Is it correct that my VoIP phones can't update through tftp when they are behind pfsense? I can't get this working and it seems that it is a problem with no solution. Anyone had luck with this?

The pfSense book says (p150) TFTP will not work through pfSense 1.2. pFsense 2.0 includes a TFTP proxy that eliminates this limitation.

@Eugene:

Technically to allow your IP phones to download from public TFTP server it is enough to open UDP port 69.

The pfSense book says the TFTP server is supposed to reply from a pseudo random source port rather than port 69. Consequently the firewall code thinks a TFTP response is unsolicited (the pseudo random source port doesn't match the destination port of previously seen traffic from the LAN) and blocks it.

danswartz · Feb 22, 2010, 1:42 PM

good point, wallaby, i'd forgotten about that. the protocol is that the first packet arrives on port 69, the first reply is sent from an ephemeral port, and the client's subsequent requests are sent to that port (i think it's done that way so it will work out of inetd.)

Eugene · Feb 22, 2010, 3:26 PM

@wallabybob:

The pfSense book says (p150) TFTP will not work through pfSense 1.2. pFsense 2.0 includes a TFTP proxy that eliminates this limitation.

I am sorry I was wrong. Forgot this specifics.

Eugene · Feb 27, 2010, 3:06 PM

TFTP proxy is the only way.

wallabybob · Feb 28, 2010, 1:59 AM

Just to elaborate on the previous reply because the question didn't make the context plain. TFTP on "local" subnets (routing between source and destination but not NAT) shouldn't be any problem. TFTP through NAT (e.g. to Internet) requires a TFTP proxy as discussed earlier in this topic.