TFTP broken in PI 1.x because of iptables

Question

Hi All
I recently upgraded our PI 1.2.1 to 1.3. It all worked fine but I had no more TFTP working. It didn't really work in the previous version, but now it didn't work at all. I could neither put nor get a file.
So today I checked out some system setting and finally found the reason within iptables.
Please note, this requires root access to the PI 1.3
Here:
ade # tftp -v -c put /localdisk/defaultRepo/cpi1.domain.com_neu.csr cpi1.domain.com_neu.csr
(to) x.x.x.x
Connected to x.x.x.x (x.x.x.x), port 69
putting /localdisk/defaultRepo/cpi1.domain.com_neu.csr to x.x.x.x:cpi1.domain.com_neu.csr [netascii]
Transfer timed out.
So this is the error message when doing it on the root shell. This error always appeared.
Now disabling iptables and doing it again:
ade # /etc/init.d/iptables stop
Flushing firewall rules: [  OK  ]
Setting chains to policy ACCEPT: filter [  OK  ]
Unloading iptables modules: [  OK  ]
ade #
ade #
ade # tftp -v -c put /localdisk/defaultRepo/cpi1.domain.com_neu.csr cpi1.domain.com_neu.csr
(to) x.x.x.x
Connected to x.x.x.x (x.x.x.x), port 69
putting /localdisk/defaultRepo/cpi1.domain.com_neu.csr to x.x.x.x:cpi1.domain.com_neu.csr [netascii]
Sent 1062 bytes in 0.0 seconds [394426 bit/s]
And bang, it worked on the first try!
And reenabling iptables:
ade # /etc/init.d/iptables start                                                   
Applying iptables firewall rules: [  OK  ]
Anybody else also having those problems?
I'm sadly an absolute iptables beginner and don't really know how to troubleshoot this more (even though I expect it to be working from start).
Thanks,
Patrick

Answer 1

Also doesn't help.
But I found now a working solution. It indeed seems to be a wrong configured iptables. The issue is with the dynamic high-ports of TFTP which aren't allowed by default on iptables.
Here I found the hint that works: http://nartax.com/2012/04/iptables-rule-for-tftp/
So I logged in as root, edited the config file
vi /etc/sysconfig/iptables-config
And changed
IPTABLES_MODULES=""
to
IPTABLES_MODULES="ip_conntrack_tftp"      
After saving it with :wq I restarted iptables and also restarted ncs (this is needed as some iptables rules are loaded when ncs starts and are lost when iptables is restarted!).
I'm checking if I can open a TAC case for this, so it might get fixed in some future version.
Patrick
[edit]
Can't open a TAC, my permission level is not enought
Message was edited by: Patrick Oberli
Added comment about TAC