samba - Mar 2002 - security/firewall rules

Hello Samba users,

I'm woundering if anyone has put together a rule set to allow Samba to run
over a firewall (?).  I would like to know what iptable rules need to be
inserted to allow for proper opperation without allowing anything to slip
through.  (Assume all other priviledged ports are blocked, and unpriviledged
ports require established/related connections.)

Here's what I have currently (as a guess):
$IPTABLES -A INPUT -i $EXT -p tcp --dport 137:139 -j TCPACCEPT
$IPTABLES -A INPUT -i $EXT -p udp --dport 137:139 -j ACCEPT
$IPTABLES -A INPUT -i $EXT -p tcp --dport 445 -j TCPACCEPT
$IPTABLES -A INPUT -i $EXT -p udp --dport 445 -j ACCEPT

$IPTABLES -A INPUT -i $EXT -p udp --sport 137:139 -j ACCEPT

$IPTABLES -A OUTPUT -o $EXT -p tcp --sport 137:139 -j ACCEPT
$IPTABLES -A OUTPUT -o $EXT -p udp --sport 137:139 -j ACCEPT
$IPTABLES -A OUTPUT -o $EXT -p tcp --sport 445 -j ACCEPT
$IPTABLES -A OUTPUT -o $EXT -p udp --sport 445 -j ACCEPT

TCPACCEPT is a chain that checks for floods, then accepts if no limits have
been reached.

Please do not respond by telling me not to run Samba or to run another
service!

Thank you!
Paul Miller

Paul,

Just in case you haven't read this already:
http://people.unix-fu.org/andreasson/iptables-tutorial/iptables-tutorial
.html

Special chain to accept related and established connections. 
Otherwise log and drop incoming packets: 

$IPTABLES -N keep_state
## Packets from invalid conn.
$IPTABLES -A keep_state -m state --state INVALID -j DROP
## Packets belonging to existing conn.
$IPTABLES -A keep_state -m state --state RELATED,ESTABLISHED -j ACCEPT
## log and trash
$IPTABLES -A keep_state -m limit --limit 3/minute --limit-burst 3 -j LOG
--log-level notice --log-prefix "dropped: "
$IPTABLES -A keep_state -j DROP

$EXT_SERVER_IP is your external server you want to connect, allow
outgoing and incoming TCP and UDP connections from this IP address only:

$IPTABLES -A INPUT   -p tcp -s $EXT_SERVER_IP --sport 1024: --dport
137:139 -j ACCEPT
$IPTABLES -A OUTPUT  -p tcp -o $EXT_SERVER_IP --sport 137:139 --dport
1024: -j keep_state
$IPTABLES -A OUTPUT  -p tcp -o $EXT_SERVER_IP --sport 1024: --dport
137:139 -j ACCEPT
$IPTABLES -A INPUT   -p tcp -s $EXT_SERVER_IP --sport 137:139 --dport
1024: -j keep_state
$IPTABLES -A INPUT   -p udp -s $EXT_SERVER_IP --dport 137:139 -j ACCEPT
$IPTABLES -A OUTPUT  -p udp -o $EXT_SERVER_IP --dport 137:139 -j ACCEPT

Good luck,
Uli