I'm running Archlinux and trying to set up hostname resolution using netbios. I'm currently in the situation where resolution only works when the firewall is disabled.

My test: I run 'ping SERVER' to see if resolution succeeds.

Results: this only succeeds when I disable the firewall, even though I opened all relevant ports 137 udp for name resolution. I have run wireshark to see what happens with the traffic:

  • step 1: broadcast query for SERVER, my source port random, server destination port 137
  • step 2: server responds to my on my random source port.
  • step 3a (with firewall): random source port is closed, destination unreachable
  • step 3b (without firewall): response is received, host is resolved and I start PINGing

My firewall, similar to this example:

table inet filter {
    chain input {
        type filter hook input priority 0; policy drop;
        ct state established,related accept
        iif "lo" accept
        ct state invalid drop
        ip protocol icmp icmp type echo-request ct state new accept
        ip protocol udp ct state new jump UDP
        ip protocol tcp tcp flags & (fin | syn | rst | ack) == syn ct state new jump TCP
        ip protocol udp reject
        ip protocol tcp reject with tcp reset
        meta nfproto ipv4 counter packets 0 bytes 0 reject with icmp type prot-unreachable

    chain forward {
        type filter hook forward priority 0; policy drop;

    chain output {
        type filter hook output priority 0; policy accept;

    chain TCP {
        tcp dport netbios-ssn accept
        tcp dport microsoft-ds accept

    chain UDP {
        udp dport netbios-ns accept
        udp dport netbios-dgm accept

My best guess is that the response to the broadcast doesn't register as 'established,related' traffic. How can I solve this?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.