randalls at bioinfo.wsu.edu
2010-Mar-05 21:42 UTC
[Samba] Not another SAMBA through a firewall post
I suppose a few questions pop up on this list about access Samba through a firewall. ?I have been very successful running Samba through a firewall, until today. ?I hit a stumbling block. I have a Linux Firewall with the public IP Address of 134.x.x.140 <it is not the exact ip address, but close>. ?I am using NAT and port forwarding to send traffic destined for 137, 138,139, and 445 for BOTH TCP and IP to an internal host of 10.0.0.245. ?This internal host has two network interface cards, 10.0.0.245 and 10.0.0.246. ? Here are my firewall rules: ??$IPTABLES -A PREROUTING -t nat -i $EXTIF -p tcp --dport 137 -d 134.x.x.140 -j DNAT --to-destination 10.0.0.245:137 ??$IPTABLES -A PREROUTING -t nat -i $EXTIF -p udp --dport 137 -d 134.x.x.140 -j DNAT --to-destination 10.0.0.245:137 ??$IPTABLES -A PREROUTING -t nat -i $EXTIF -p tcp --dport 138 -d 134.x.x.140 -j DNAT --to-destination 10.0.0.245:138 ??$IPTABLES -A PREROUTING -t nat -i $EXTIF -p udp --dport 138 -d 134.x.x.140 -j DNAT --to-destination 10.0.0.245:138 ??$IPTABLES -A PREROUTING -t nat -i $EXTIF -p tcp --dport 139 -d 134.x.x.140 -j DNAT --to-destination 10.0.0.245:139 ??$IPTABLES -A PREROUTING -t nat -i $EXTIF -p udp --dport 139 -d 134.x.x.140 -j DNAT --to-destination 10.0.0.245:139 ??$IPTABLES -A PREROUTING -t nat -i $EXTIF -p tcp --dport 445 -d 134.x.x.140 -j DNAT --to-destination 10.0.0.245:445 ??$IPTABLES -A PREROUTING -t nat -i $EXTIF -p udp --dport 445 -d 134.x.x.140 -j DNAT --to-destination 10.0.0.245:445 ??$IPTABLES -t nat -A POSTROUTING -o eth0 -p tcp -s 10.0.0.245 -j SNAT --to-source 134.x.x.140 ??$IPTABLES -t nat -A POSTROUTING -o eth0 -p udp -s 10.0.0.245 -j SNAT --to-source 134.x.x.140 ??$IPTABLES -t nat -A POSTROUTING -o eth0 -p tcp -s 10.0.0.245 -j SNAT --to-source 134.x.x.140 ??$IPTABLES -t nat -A POSTROUTING -o eth0 -p udp -s 10.0.0.245 -j SNAT --to-source 134.x.x.140 When I have both network cards activated, I am unable to access SAMBA through the firewall. ?However, I can access them on the local LAN. ?I try to tell Samba to use eth0 and lo using: interfaces = lo eth0 bind interfaces only = yes Still does not work. ?I can use tcpdump -i eth0 and I can packets going through the firewall: 13:36:10.904331 IP 134.x.x.19.34251 > 10.0.0.245.139: S 2273296206:2273296206(0) win 5840 <mss 1460,sackOK,timestamp 4731872 0,nop,wscale 7> And also I can see the requests arriving on eth0 on the Samba server: 13:35:55.777985 IP 134.x.x.19.34251 > 10.0.0.245.139: Flags [S], seq 2273296206, win 5840, options [mss 1460,sackOK,TS val 4731872 ecr 0,nop,wscale 7], length 0 I am at a loss as to why this is happening. ?Anyone care to enlighten me? Randall Svancara
NAT relies on port forwarding. To do pre/post routing, I believe you must indicate FORWARDING rules for incoming and outgoing traffic on that port: $IPT -t filter -A FORWARD -i $INTIF -o $EXTIF -p tcp --dport 137 --syn -m state --state NEW -j ACCEPT $IPT -t filter -A FORWARD -o $INTIF -i $EXTIF -p tcp --dport 137 --syn -m state --state NEW -j ACCEPT $IPT -t filter -A FORWARD -i $INTIF -o $EXTIF -p tcp --dport 138 --syn -m state --state NEW -j ACCEPT $IPT -t filter -A FORWARD -o $INTIF -i $EXTIF -p tcp --dport 138 --syn -m state --state NEW -j ACCEPT $IPT -t filter -A FORWARD -i $INTIF -o $EXTIF -p tcp --dport 139 --syn -m state --state NEW -j ACCEPT $IPT -t filter -A FORWARD -o $INTIF -i $EXTIF -p tcp --dport 139 --syn -m state --state NEW -j ACCEPT $IPT -t filter -A FORWARD -i $INTIF -o $EXTIF -p tcp --dport 445 --syn -m state --state NEW -j ACCEPT $IPT -t filter -A FORWARD -o $INTIF -i $EXTIF -p tcp --dport 445 --syn -m state --state NEW -j ACCEPT Do you have similar forwarding rules? HTH, Mike
I think part of your problem is that both of your NICs are on the same subnet. That will usually cause headaches; it confuses the routing table. It is entirely possible that Samba responds from IP 10.0.0.246 even when the connection goes to .245 - and you don't have firewall rules for that. Note that the interfaces statement isn't necessarily going to help - you should actually shut down the second NIC (ifdown eth1) to have it completely removed from Linux. Also, at least for testing, I would also simplify the setup - only use port 445, and only tcp. That way, you only have to debug one rule instead of eight. Use telnet to test if you can reach the Samba server from the outside world. Also, only use UDP and TCP, not both. 137 and 138 should be UDP; 139 and 445 should be TCP.> -----Original Message----- > From: samba-bounces at lists.samba.org [mailto:samba- > bounces at lists.samba.org] On Behalf Of randalls at bioinfo.wsu.edu > Sent: Friday, March 05, 2010 1:42 PM > To: samba at lists.samba.org > Subject: [Samba] Not another SAMBA through a firewall post > > I suppose a few questions pop up on this list about access Samba > through a firewall. ?I have been very successful running Samba through > a firewall, until today. ?I hit a stumbling block. > > I have a Linux Firewall with the public IP Address of 134.x.x.140 <it > is not the exact ip address, but close>. ?I am using NAT and port > forwarding to send traffic destined for 137, 138,139, and 445 for BOTH > TCP and IP to an internal host of 10.0.0.245. ?This internal host has > two network interface cards, 10.0.0.245 and 10.0.0.246. > > Here are my firewall rules: > > ??$IPTABLES -A PREROUTING -t nat -i $EXTIF -p tcp --dport 137 -d > 134.x.x.140 -j DNAT --to-destination 10.0.0.245:137 > ??$IPTABLES -A PREROUTING -t nat -i $EXTIF -p udp --dport 137 -d > 134.x.x.140 -j DNAT --to-destination 10.0.0.245:137 > > ??$IPTABLES -A PREROUTING -t nat -i $EXTIF -p tcp --dport 138 -d > 134.x.x.140 -j DNAT --to-destination 10.0.0.245:138 > ??$IPTABLES -A PREROUTING -t nat -i $EXTIF -p udp --dport 138 -d > 134.x.x.140 -j DNAT --to-destination 10.0.0.245:138 > > ??$IPTABLES -A PREROUTING -t nat -i $EXTIF -p tcp --dport 139 -d > 134.x.x.140 -j DNAT --to-destination 10.0.0.245:139 > ??$IPTABLES -A PREROUTING -t nat -i $EXTIF -p udp --dport 139 -d > 134.x.x.140 -j DNAT --to-destination 10.0.0.245:139 > > ??$IPTABLES -A PREROUTING -t nat -i $EXTIF -p tcp --dport 445 -d > 134.x.x.140 -j DNAT --to-destination 10.0.0.245:445 > ??$IPTABLES -A PREROUTING -t nat -i $EXTIF -p udp --dport 445 -d > 134.x.x.140 -j DNAT --to-destination 10.0.0.245:445 > > ??$IPTABLES -t nat -A POSTROUTING -o eth0 -p tcp -s 10.0.0.245 -j SNAT > --to-source 134.x.x.140 > ??$IPTABLES -t nat -A POSTROUTING -o eth0 -p udp -s 10.0.0.245 -j SNAT > --to-source 134.x.x.140 > ??$IPTABLES -t nat -A POSTROUTING -o eth0 -p tcp -s 10.0.0.245 -j SNAT > --to-source 134.x.x.140 > ??$IPTABLES -t nat -A POSTROUTING -o eth0 -p udp -s 10.0.0.245 -j SNAT > --to-source 134.x.x.140 > > When I have both network cards activated, I am unable to access SAMBA > through the firewall. ?However, I can access them on the local LAN. ?I > try to tell Samba to use eth0 and lo using: > > interfaces = lo eth0 > bind interfaces only = yes > > Still does not work. ?I can use tcpdump -i eth0 and I can packets going > through the firewall: > 13:36:10.904331 IP 134.x.x.19.34251 > 10.0.0.245.139: S > 2273296206:2273296206(0) win 5840 <mss 1460,sackOK,timestamp 4731872 > 0,nop,wscale 7> > > And also I can see the requests arriving on eth0 on the Samba server: > 13:35:55.777985 IP 134.x.x.19.34251 > 10.0.0.245.139: Flags [S], seq > 2273296206, win 5840, options [mss 1460,sackOK,TS val 4731872 ecr > 0,nop,wscale 7], length 0 > > I am at a loss as to why this is happening. ?Anyone care to enlighten > me? > > Randall Svancara > > > > -- > To unsubscribe from this list go to the following URL and read the > instructions: https://lists.samba.org/mailman/options/samba