[Shorewall-users] Samba

John Andersen
Tue, 28 May 2002 18:43:14 -0000

My Firewall is also my samba server (I know, I know, not the best idea).

When I code the rules for SAMBA as shown on the web page
I get udp packets from the FW to LOC on port 137 blocked by the
all2all chain as shown below:

May 28 10:16:44 norcomix kernel: Shorewall:all2all:REJECT:IN= OUT=eth1
SRC=192.168.2.80 DST=192.168.2.143
LEN=90 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=137 DPT=32787 LEN=70

Apparently the rules as shown on the web page are not sufficient to
allow all SMB packets to be transmitted.  I think that this is because
they filter on destination port (which is 32787 in this example) rather
than source port.

Loss of these seems to cause LinNeighborhood a great deal of
grief as it refuses to browse the network any further.  (Oddly these
are packets are not missed by the windows stations.

If I add a line in the POLICY file like this:
 fw loc accept

These packets are no longer dropped and everything works.

Question:  Is this dangerous?   Is there a better way?

______________________________________
John Andersen
NORCOM / Juneau, Alaska