UDP netbios nameserver packets blocked

UDP netbios nameserver packets blocked

[Knute Johnson]

I have the following line in my iptables configuration;

-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

When I use the smbclient command, it attempts a DNS lookup, which fails 
as it should, then does a netbios nameserver lookup.  The response is 
getting blocked with the last line in my configuration;

-A INPUT -j REJECT --reject-with icmp-host-prohibited

I can make it work if I put in the following;

-A INPUT -p udp --sport 137 -j ACCEPT

but I thought the top line should have allowed the response to pass 
through.  It is coming back on the same port as it was sent on.

Any insight would be appreciated.

Thanks,

-- 

Knute Johnson
knute2008@www.knutejohnson.com

Re: UDP netbios nameserver packets blocked

[Gáspár Lajos]

Hello,

I think that you did not load the nf_conntrack_netbios_ns module...

Just to be clear: DNS != NETBIOS NS !!!

Swifty

Knute Johnson írta:
> I have the following line in my iptables configuration;
>
> -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
>
> When I use the smbclient command, it attempts a DNS lookup, which 
> fails as it should, then does a netbios nameserver lookup.  The 
> response is getting blocked with the last line in my configuration;
>
> -A INPUT -j REJECT --reject-with icmp-host-prohibited
>
> I can make it work if I put in the following;
>
> -A INPUT -p udp --sport 137 -j ACCEPT
>
> but I thought the top line should have allowed the response to pass 
> through.  It is coming back on the same port as it was sent on.
>
> Any insight would be appreciated.
>
> Thanks,
>

Re: UDP netbios nameserver packets blocked

[Knute Johnson]

Gáspár Lajos wrote:
> Hello,
> 
> I think that you did not load the nf_conntrack_netbios_ns module...

You're right!

> Just to be clear: DNS != NETBIOS NS !!!

I do know that.  That was why I was surprised that DNS worked and NBNS 
didn't.

Can you point me to a list of the modules what they do?

Thanks very much,

-- 

Knute Johnson
knute2008@www.knutejohnson.com

Re: UDP netbios nameserver packets blocked

[Gáspár Lajos]

Hello,

Knute Johnson írta:
> Can you point me to a list of the modules what they do?
>
> Thanks very much,
Every nf_conntrack* module extends the whole conntracking subsystem.
The name tells you the protocol.

Check your modules directory

Swifty