3

Which iptables-rules do I have to set to allow clients to access a samba server with working netbios (i.e. being able to use \MyServer instead of \192.168.0.1 to access the server from Windows)?

I've got a small office server which is doing NAT/masquerading between the internal and external net and serves dns (forwarding), dhcp and samba with netbios server to the internal net.

My current iptables configuration:

    # Loeschen aller vorhandener Regeln
    $IPT -F

    # Default Policy setzen
    $IPT -P INPUT DROP
    $IPT -P OUTPUT DROP
    $IPT -P FORWARD DROP

    # Loopback komplett freischalten
    $IPT -A INPUT -i $LO -j ACCEPT
    $IPT -A OUTPUT -o $LO -j ACCEPT

    # Bestehende Verbindungen auf allen Interfaces erlauben
    $IPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
    $IPT -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

    # Ping auf allen Interfaces erlauben
    $IPT -A INPUT -p icmp -j ACCEPT

    # Eingehende Verbindungen aus dem internen Netz erlauben
    # SSH, HTTP, HTTPS, Squid
    $IPT -A INPUT -i $INT -m state --state NEW -m multiport -p tcp --dport 22,80,443,8080  -j ACCEPT
    # DNS
    $IPT -A INPUT -i $INT -m state --state NEW -p tcp --dport domain -j ACCEPT
    $IPT -A INPUT -i $INT -m state --state NEW -p udp --dport domain -j ACCEPT
    # Samba
    $IPT -A INPUT -i $INT -m state --state NEW -p udp --dport 137 -j ACCEPT
    $IPT -A INPUT -i $INT -m state --state NEW -p udp --dport 138 -j ACCEPT
    $IPT -A INPUT -i $INT -m state --state NEW -p tcp --dport 139 -j ACCEPT
    $IPT -A INPUT -i $INT -m state --state NEW -p tcp --dport 445 -j ACCEPT

    # Ausgehende Verbindungen ins interne Netz erlauben
    # Samba
    $IPT -A OUTPUT -o $INT -m state --state NEW -p udp --sport 137 -j ACCEPT
    $IPT -A OUTPUT -o $INT -m state --state NEW -p udp --sport 138 -j ACCEPT
    $IPT -A OUTPUT -o $INT -m state --state NEW -p tcp --sport 139 -j ACCEPT
    $IPT -A OUTPUT -o $INT -m state --state NEW -p tcp --sport 445 -j ACCEPT

    # Eingehende Verbindungen aus dem externen Netz erlauben
    # SSH vom Sprungserver
    $IPT -A INPUT -i $EXT -p tcp -s 1.2.3.4 --dport 22 -j ACCEPT

    # Ausgehende Verbindungen ins externe Netz erlauben
    # HTTP
    $IPT -A OUTPUT -o $EXT -m state --state NEW -p tcp --dport http -j ACCEPT
    # DNS
    $IPT -A OUTPUT -o $EXT -m state --state NEW -p udp --dport domain -j ACCEPT
    $IPT -A OUTPUT -o $EXT -m state --state NEW -p tcp --dport domain -j ACCEPT

    # Transparenter Proxy für HTTP über Squid
    $IPT -t nat -A PREROUTING -i $INT -p tcp --dport 80 -j REDIRECT --to-port 8080

    # Routing
    # Forwarding
    $IPT -A FORWARD -i $INT -o $EXT -j ACCEPT
    $IPT -A FORWARD -i $EXT -o $INT -m state --state RELATED,ESTABLISHED -j ACCEPT
    # NAT
    $IPT -t nat -A POSTROUTING -o $EXT -j MASQUERADE

With this ruleset the access via ip-address functions well but there is no working name resolution. Which ports do I have to allow?

I checked the functionality with smbclient both from the server itself and from the client:

root@client:~# smbclient -L //192.168.40.254/
Enter root's password:
Domain=[WORKGROUP] OS=[Unix] Server=[Samba 3.6.6]

    Sharename       Type      Comment
    ---------       ----      -------
    IPC$            IPC       IPC Service (samba-debian)
    lehrer          Disk      Lehrer
    print$          Disk      Printer Drivers
Domain=[WORKGROUP] OS=[Unix] Server=[Samba 3.6.6]

    Server               Comment
    ---------            -------
    SAMBA-DEBIAN         samba-debian

    Workgroup            Master
    ---------            -------
    WORKGROUP            SAMBA-DEBIAN



root@client:~# smbclient -L //samba-debian/
Enter root's password:
Connection to samba-debian failed (Error NT_STATUS_CONNECTION_REFUSED)



root@samba-debian:~# smbclient -L //192.168.40.254/
Enter root's password:
Domain=[WORKGROUP] OS=[Unix] Server=[Samba 3.6.6]

    Sharename       Type      Comment
    ---------       ----      -------
    IPC$            IPC       IPC Service (samba-debian)
    lehrer          Disk      Lehrer
    print$          Disk      Printer Drivers
Domain=[WORKGROUP] OS=[Unix] Server=[Samba 3.6.6]

    Server               Comment
    ---------            -------
    SAMBA-DEBIAN         samba-debian

    Workgroup            Master
    ---------            -------
    WORKGROUP            SAMBA-DEBIAN



root@samba-debian:~# smbclient -L //samba-debian/
Enter root's password:
Domain=[WORKGROUP] OS=[Unix] Server=[Samba 3.6.6]

    Sharename       Type      Comment
    ---------       ----      -------
    IPC$            IPC       IPC Service (samba-debian)
    lehrer          Disk      Lehrer
    print$          Disk      Printer Drivers
Domain=[WORKGROUP] OS=[Unix] Server=[Samba 3.6.6]

    Server               Comment
    ---------            -------
    SAMBA-DEBIAN         samba-debian

    Workgroup            Master
    ---------            -------
    WORKGROUP            SAMBA-DEBIAN

Besides it works when I disable the firewalling completely - therefore the reason should be in the iptables-code.

Doing a tcpdump on the server on port 53 on the internal interface - there is nothing:

root@samba-debian:~# tcpdump -i eth1 port 53
listening on eth1, link-type EN10MB (Ethernet), capture size 65535 bytes
^C
0 packets captured
0 packets recieved by filter
0 packets recieved by kernel
8
  • Could you cut-and-paste into your question an example of name resolution failing? Preferably as precise a one as possible.
    – MadHatter
    Feb 6, 2014 at 9:23
  • Can you try to tcpdump the traffic at FW side, filtering on port 53, and see what happens ?
    – krisFR
    Feb 6, 2014 at 13:58
  • @user2196728 Hm, unfortunately there is nothing... Nevertheless, thanks for your ideas. Anymore?
    – Andreas
    Feb 7, 2014 at 8:03
  • What does your samba.conf file look like? Feb 7, 2014 at 8:07
  • Very strange: a windows client I installed for testing works well with the above configuration. So I think the problems lies within some samba configuration. Sorry for asking the wrong question here...
    – Andreas
    Feb 7, 2014 at 13:08

1 Answer 1

1

One of the useful thing to do is to insert the following log filter at the end of the iptables rule file.

$IPT -A OUTPUT -m limit --limit 2/min -j LOG --log-prefix "IPTables-OUTPUT-Dropped: " --log-level 4
$IPT -A INPUT -m limit --limit 2/min -j LOG --log-prefix "IPTables-INPUT-Dropped: " --log-level 4
$IPT -A FORWARD -m limit --limit 2/min -j LOG --log-prefix "IPTables-FWD-Dropped: " --log-level 4

The above will report what is missing and I'm guessing that FORWARD will log those message for you.

If you want your SMB server to be accessible from beyond one router hop, you will find that you also need to insert the same 4 rules for -A FORWARD (port 137, 138, 139, 445)

While I am not a SMB expert, you may want to add port 137/tcp, 138/tcp, 139/udp as well in each of INPUT, OUTPUT and if externally needed, FORWARD as well.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .