looking for rules for samba-related traffic

looking for rules for samba-related traffic

[Robert P. J. Day]

  (sorry if you already saw this -- due to the fact that i've
been messing with my iptables setup, i'm not sure this made
it out the first time.)

  i'm looking for the ruleset to filter all samba-related
traffic.  i realize that this involves ports 137-9, based
on what i see in /etc/services.  but i did a quick google
search and a couple sample sets i've seen refer to TCP 
traffic, when i've already confirmed that, for example,
nmblookup is UDP.

  so, anyone have a pointer to a nicely-annotated set of
rules for samba, mounting filesystems, printing, etc?
thanks.  

  in the meantime, i'll just keep experimenting and 
watching the packets.

rday

Re: looking for rules for samba-related traffic

[Anthony M. Rasat]

Dear Robert,

Most times, when configuring a firewall, people blocked everything first
then allow any service required. This goes for any incoming traffic rule.
Now, outgoing rule may vary. Some people like to let any outgoing traffic
may pass unchanged, some are not. In your case, if you wish to do so, your
can set rules to block outgoing TCP and UDP port 137 - 139. This rules will
not affecting Samba (or Microsoft Windows Network Sharing Service)
communication inside your internal network.

Examples? I think
http://www.linuxguruz.org/iptables/scripts/rc.firewall_002.txt should
answered the question.

 Regards,

A.


----- Original Message -----
From: "Robert P. J. Day" <rpjday@mindspring.com>
To: "iptables mailing list" <netfilter@lists.netfilter.org>
Sent: Monday, April 07, 2003 1:31 AM
Subject: looking for rules for samba-related traffic


>
>   (sorry if you already saw this -- due to the fact that i've
> been messing with my iptables setup, i'm not sure this made
> it out the first time.)
>
>   i'm looking for the ruleset to filter all samba-related
> traffic.  i realize that this involves ports 137-9, based
> on what i see in /etc/services.  but i did a quick google
> search and a couple sample sets i've seen refer to TCP
> traffic, when i've already confirmed that, for example,
> nmblookup is UDP.
>
>   so, anyone have a pointer to a nicely-annotated set of
> rules for samba, mounting filesystems, printing, etc?
> thanks.
>
>   in the meantime, i'll just keep experimenting and
> watching the packets.
>
> rday
>
>
>
>
>

Re: looking for rules for samba-related traffic

[Robert P. J. Day]

On Mon, 7 Apr 2003, Anthony M. Rasat wrote:

> Dear Robert,
> 
> Most times, when configuring a firewall, people blocked everything first
> then allow any service required. This goes for any incoming traffic rule.
> Now, outgoing rule may vary. Some people like to let any outgoing traffic
> may pass unchanged, some are not. In your case, if you wish to do so, your
> can set rules to block outgoing TCP and UDP port 137 - 139. This rules will
> not affecting Samba (or Microsoft Windows Network Sharing Service)
> communication inside your internal network.

no, you have it backwards.  i'm starting from a position of DROP on all
chains, and want to slowly *open up* my firewall.  what i was after
was a set of (ideally minimal) rules that would allow just what was
needed for samba-related traffic.

i'm aware that that traffic involves ports 137-9, but wanted to
know if there was a summary of *precisely* what ports were involved,
and what they were used for, so i could know exactly what i had
to allow and what i could leave closed.

rday