* Enabling Samba
@ 2003-05-09 17:36 Mark Tessier
2003-05-09 17:57 ` Jeremy C. Reed
2003-05-09 17:59 ` Myles Uyema
0 siblings, 2 replies; 3+ messages in thread
From: Mark Tessier @ 2003-05-09 17:36 UTC (permalink / raw)
To: netfilter
Hi,
I'm running iptables v1.2.1a on Red Hat 7.1 as a gateway/firewall, and have been doing so for the past year without problems. Recently, it has become necessary to run Samba on the server as well. (Note: I realize that it is not recommended to have Samba operating on a firewall, but in my case - a small home/office with limited space for servers - it's the only plausible solution.) Naturally, running a Samba server on a firewall means adding new rules to the rc.firewall script to enable access to the Samba server. I have added the following rules:
# Enable SAMBA ports (TCP/UDP Ports 137-139)
iptables -A INPUT -p tcp -m tcp --dport 137 --syn -j ACCEPT
iptables -A INPUT -p udp -m udp --dport 137 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 138 --syn -j ACCEPT
iptables -A INPUT -p udp -m udp --dport 138 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 139 --syn -j ACCEPT
iptables -A INPUT -p udp -m udp --dport 139 -j ACCEPT
These rules don't work, unfortunately. When I attempt to access the server with my Windows 98 machine, the server starts spewing a bunch of error packets such as:
IN= OUT=eth1 SRC=192.168.0.254 DST 192.168.0.255 LEN=240 TOS=0x00 PREC=0x00 TTL=64 ID=0 PROTO=UDP SPT=138 DPT=138 LEN=220
I also get a strange error packet, as if the Win98 client wants to send UDP packets to the name server from sport 137 to dport 53...
To get Samba working, I have to flush the firewall and restart the Samba servers.
Could anyone recommend rules to get Samba working on my firewall?
Thanks in advance,
Mark
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: Enabling Samba
2003-05-09 17:36 Enabling Samba Mark Tessier
@ 2003-05-09 17:57 ` Jeremy C. Reed
2003-05-09 17:59 ` Myles Uyema
1 sibling, 0 replies; 3+ messages in thread
From: Jeremy C. Reed @ 2003-05-09 17:57 UTC (permalink / raw)
To: Mark Tessier; +Cc: netfilter
On Fri, 9 May 2003, Mark Tessier wrote:
> iptables -A INPUT -p tcp -m tcp --dport 137 --syn -j ACCEPT
> iptables -A INPUT -p udp -m udp --dport 137 -j ACCEPT
>
> iptables -A INPUT -p tcp -m tcp --dport 138 --syn -j ACCEPT
> iptables -A INPUT -p udp -m udp --dport 138 -j ACCEPT
>
> iptables -A INPUT -p tcp -m tcp --dport 139 --syn -j ACCEPT
> iptables -A INPUT -p udp -m udp --dport 139 -j ACCEPT
What about your OUTPUT (or policy for OUTPUT)?
Jeremy C. Reed
http://bsd.reedmedia.net/
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: Enabling Samba
2003-05-09 17:36 Enabling Samba Mark Tessier
2003-05-09 17:57 ` Jeremy C. Reed
@ 2003-05-09 17:59 ` Myles Uyema
1 sibling, 0 replies; 3+ messages in thread
From: Myles Uyema @ 2003-05-09 17:59 UTC (permalink / raw)
To: Mark Tessier; +Cc: netfilter
What are your OUTPUT rules? It looks like your firewall 192.168.0.254 is
trying to send broadcast packets (which SMB does) in order to announce
itself to the rest of the network.
Your INPUT rules look fine, but I would suggest using -i eth1 so that
Samba is only visible to the ETH1 private lan.
iptables -A OUTPUT -p tcp -p tcp --sport 137:139 -j ACCEPT
iptables -A OUTPUT -p udp -p udp --sport 137:139 -j ACCEPT
UDP port 53 is DNS. Windows 95/98 will query for a DNS response as well I
suppose.
On Fri, 9 May 2003, Mark Tessier wrote:
Hi,
I'm running iptables v1.2.1a on Red Hat 7.1 as a gateway/firewall, and have been doing so for the past year without problems. Recently, it has become necessary to run Samba on the server as well. (Note: I realize that it is not recommended to have Samba operating on a firewall, but in my case - a small home/office with limited space for servers - it's the only plausible solution.) Naturally, running a Samba server on a firewall means adding new rules to the rc.firewall script to enable access to the Samba server. I have added the following rules:
# Enable SAMBA ports (TCP/UDP Ports 137-139)
iptables -A INPUT -p tcp -m tcp --dport 137 --syn -j ACCEPT
iptables -A INPUT -p udp -m udp --dport 137 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 138 --syn -j ACCEPT
iptables -A INPUT -p udp -m udp --dport 138 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 139 --syn -j ACCEPT
iptables -A INPUT -p udp -m udp --dport 139 -j ACCEPT
These rules don't work, unfortunately. When I attempt to access the server with my Windows 98 machine, the server starts spewing a bunch of error packets such as:
IN= OUT=eth1 SRC=192.168.0.254 DST 192.168.0.255 LEN=240 TOS=0x00 PREC=0x00 TTL=64 ID=0 PROTO=UDP SPT=138 DPT=138 LEN=220
I also get a strange error packet, as if the Win98 client wants to send UDP packets to the name server from sport 137 to dport 53...
To get Samba working, I have to flush the firewall and restart the Samba servers.
Could anyone recommend rules to get Samba working on my firewall?
Thanks in advance,
Mark
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2003-05-09 17:59 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2003-05-09 17:36 Enabling Samba Mark Tessier
2003-05-09 17:57 ` Jeremy C. Reed
2003-05-09 17:59 ` Myles Uyema
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.