0

I can not seem to get samba to work correctly without disabling iptables. As soon as I disable iptables everything works perfectly although I am not fond of not having a firewall in place. I am hoping someone can tell me what I did wrong, I am guessing there is a missing rule inside of iptables but I have searched all over and I believe I have all the rules needed.

I have the following rules set in iptables

# Firewall configuration written by system-config-securitylevel
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
-A RH-Firewall-1-INPUT -s 192.168.168.0/24 -m state --state NEW -p tcp --dport 137 -j ACCEPT
-A RH-Firewall-1-INPUT -s 192.168.168.0/24 -m state --state NEW -p tcp --dport 138 -j ACCEPT
-A RH-Firewall-1-INPUT -s 192.168.168.0/24 -m state --state NEW -p tcp --dport 139 -j ACCEPT
-A RH-Firewall-1-INPUT -s 192.168.168.0/24 -m state --state NEW -p tcp --dport 445 -j ACCEPT
COMMIT

The ip addresses I am connecting from are: 192.168.168.62 192.168.168.84 So they should not be getting rejected.

When I run the command netstat -tulpn | egrep "samba|smbd|nmbd|winbind" I get back:

tcp        0      0 0.0.0.0:139                 0.0.0.0:*                   LISTEN      2972/smbd
tcp        0      0 0.0.0.0:445                 0.0.0.0:*                   LISTEN      2972/smbd
udp        0      0 192.168.168.88:137          0.0.0.0:*                               2953/nmbd
udp        0      0 0.0.0.0:137                 0.0.0.0:*                               2953/nmbd
udp        0      0 192.168.168.88:138          0.0.0.0:*                               2953/nmbd
udp        0      0 0.0.0.0:138                 0.0.0.0:*                               2953/nmbd

The global section of my smb.conf file are:

        lanman auth = no
        obey pam restrictions = yes
        client ntlmv2 auth = yes
        client signing = yes
        ntlm auth = no
        map to guest = bad user
        passwd program = /usr/bin/passwd %u
        passdb backend = tdbsam
        dns proxy = no
        unix password sync = yes
        security = user
        usershare allow guests = yes
        workgroup = WORKGROUP
        server string = %h server
        netbios name = QUICKBOOKS
        interfaces = lo eth0 192.168.168.88
        hosts allow = 192.168.168.0/24

The share section of smb.conf are:

[quickbooks]
path = /home/quickbooks
public = no
browseable = yes
guest ok = yes
writeable = yes
guest only = yes
read only = no
follow symlinks = yes
wide links = no
create mask = 0777
force user = quickbooks

2 Answers 2

1

Ports 137 and 138 should be opened for UDP traffic instead of TCP:

-A RH-Firewall-1-INPUT -s 192.168.168.0/24 -m state --state NEW -p udp --dport 137 -j ACCEPT
-A RH-Firewall-1-INPUT -s 192.168.168.0/24 -m state --state NEW -p udp --dport 138 -j ACCEPT
-A RH-Firewall-1-INPUT -s 192.168.168.0/24 -m state --state NEW -p tcp --dport 139 -j ACCEPT
-A RH-Firewall-1-INPUT -s 192.168.168.0/24 -m state --state NEW -p tcp --dport 445 -j ACCEPT

Source:

0

Just before reject rule in RH-Firewall-1-INPUT chain, add a rule that logs all traffic. It could help identify what packages are being blocked: -A RH-firewall-1-INPUT -j LOG

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .