DHCPDISCOVER witchcraft?

Question

linux

Colleagues, what kind of witchcraft is hidden in the dhcpdiscover package that the iptables -A INPUT -p udp --dport 67 -j DROP rule does not work and the packet goes further down the chain?

Answer 1

Show rules in full, iptables -nvL

Answer 2

The server responds to clients on port 68

Answer 3

I will explain - at the beginning of the INPUT chain, I prescribe the rules for discarding any network garbage on the external interface. So - I can’t drop DHCPDISCOVER in any way, for any of the parameters of the packet, the packet stubbornly continues to go further along the chain, while iptables shows 0 hits, as if the packet does not fall under the rule. I've googled all over looking for an answer. Since I already have 0 ideas, I'm guessing some kind of special processing of this package by the kernel or, perhaps, a network interface bug / feature or something like that. Perhaps someone has already encountered this and knows where to dig.

Answer 4

IPTABLES -A INPUT -i interface -dport 67:68 -sport 67:68 -j DROP