SAMBA and IPTABLES...

[Leandro Sales]

Hi, What other port should I allow to accept smb connection using IPTables? I??m allowing 137:139 just TCP?

/etc/services:
...
...
netbios-ns 137/tcp
netbios-ns 137/udp
netbios-dgm 138/tcp
netbios-dgm 138/udp
netbios-ssn 139/tcp
netbios-ssn 139/udp
...
...

Any clue?

[Leandro Sales]

and 137:139 UDP ports too...

[Mark Fenton]

As far as which ports should be allowed -- you've got it. Check your other configuration settings though, to ensure that you are allowing smb connections from the proper hosts/networks.

[Marco Paganini]

Hello Leandro.

If you use iptables, you can use the 'state' modules to track the connection status for you. In that case, allow:

- any port -> udp or tcp 137, 138 and 139, connect status NEW,ESTABLISHED,RELATED

Hope it helps,
Paga

[Leandro Sales]

Ok. I'm going to test tomorrow, now I can't do this...

Leandro.

[Mike Hassell]

Leandro,

Looks like you've got everything you need to let netbios traffic into your samba (linux) host.

I just wanted to mention that I would be very cautious with this type of configuration if this server is directly connected to the internet as the security aspects of the SMB protocol are a bit weak to say the least. I assume that this machine is behind some other type of firewall, be it hardware or software, if this is the case, then I wouldn't worry as much, however if you're allowing incoming smb connections from the internet, be sure to monitor it very closely.

-Mike

[Leandro Sales]

Hi Mike, Thanks...
The server that I use SAMBA has two interfaces for for Internal and another for a external network (Internet). I will allow incoming connection just for the internal interface, Any problem?

[Mark Fenton · Accepted solution]

Leandro,

When I was getting my SAMBA setup going a few months back -- I found the book from O'Reilly very helpful, especially the troubleshooting section:

http://www.oreilly.com/catalog/samba/chapter/book/ch09_01.html

I expect that you have already tried most of these steps already, but are still having trouble.

Since you are limiting your smb connections to your internal network -- in order to ensure that the smb distribution itself is not to blame, try allowing all services on the internal network (temporarily) and then step through shutting down services that are not needed/desired. This'll at least help to identify whether the problems you are facing are being generated by your IPTABLES rules originate from elsewhere.

hth