Linux Netfilter discussions
 help / color / mirror / Atom feed
From: Knute Johnson <knute2008@www.knutejohnson.com>
To: netfilter@vger.kernel.org
Subject: UDP netbios nameserver packets blocked
Date: Mon, 08 Dec 2008 16:39:46 -0800	[thread overview]
Message-ID: <493DBE52.1010003@www.knutejohnson.com> (raw)

I have the following line in my iptables configuration;

-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

When I use the smbclient command, it attempts a DNS lookup, which fails 
as it should, then does a netbios nameserver lookup.  The response is 
getting blocked with the last line in my configuration;

-A INPUT -j REJECT --reject-with icmp-host-prohibited

I can make it work if I put in the following;

-A INPUT -p udp --sport 137 -j ACCEPT

but I thought the top line should have allowed the response to pass 
through.  It is coming back on the same port as it was sent on.

Any insight would be appreciated.

Thanks,

-- 

Knute Johnson
knute2008@www.knutejohnson.com


             reply	other threads:[~2008-12-09  0:39 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2008-12-09  0:39 Knute Johnson [this message]
2008-12-09 10:38 ` UDP netbios nameserver packets blocked Gáspár Lajos
2008-12-09 18:38   ` Knute Johnson
2008-12-12 12:42     ` Gáspár Lajos

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=493DBE52.1010003@www.knutejohnson.com \
    --to=knute2008@www.knutejohnson.com \
    --cc=netfilter@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox