On Saturday 27 November 2004 18:38, dadirtyluk wrote:

Hey,

If the packets are coming in on the external interface you must allow the ports with

FW-SERVICES_EXT and not _INT

YaST does set it on the internal interface. But I already tried to open the TCP and UDP ports on the external interface. No luck...

On Saturday 27 November 2004 19:36, dadirtyluk wrote:

did you set fw_services_ext in /etc/sysconfig/SuSEfirewall2? or have you just 'tried' to set it somehow with yast and it didn't work out?

YaST (9.2). I didn't "try" it "somehow" but I entered 137 and 138 for external UDP ports and 139 and 445 for external TCP ports... :-)

you need to give some more information about your setup...many things can be going wrong...

ipaddresses

Well, ok: 192.168.0.255 router 192.168.0.2 my machine 192.168.0.DHCP windows machine

hardware setup (routers, hubs/switches, etc)

Netgear wireless router to which both PCs are connected.

what is working and what is not

Everything's working find except SMB. SMB isn't working at all if the FW is enabled. AFAIK one port (139?) is only for directory listings or similar but I think the problem is something else but an closed port...

On Saturday 27 November 2004 20:20, dadirtyluk wrote:

i would consider putting 2 nic's in the firewall machine and make it the only computer connected to your router

Because I do share the net with a Windows machine :-) Yes, it doesn't really make sense. But this is not about sense but why it doesn't work.

if both computers are connected to the router only the machin where the firewall is running is protected from the internet. the other one has an connection to the router and the inet without a firewall.

or am i completly misunderstanding your setup?

Nope. Absolutely correct. Well, the Windows machine does have the Windows SP2 Firewall installed anyway.

...

Everything's working find except SMB. SMB isn't working at all if the FW is enabled. AFAIK one port (139?) is only for directory listings or similar but I think the problem is something else but an closed port...

you have services on your firewall machine that you access from the other machine or what?

No. I do have services that I access from the internet. For the LAN SMB is sufficient.

you can ping the firewall computer from the other one?

Sure. And if I shut down SuSEfirewall2 everything works. It must be some stupid FW config mistake I made...

On Sunday 28 November 2004 01:04, Kai Hauser wrote:

does the firewall logs droped packets? hint: tail -f /var/log/messages

Not really, I found: Nov 28 13:22:35 tcn nmbd[4389]: [2004/11/28 13:22:35, 0] nmbd/nmbd_namequery.c:query_name_response(101) Nov 28 13:22:35 tcn nmbd[4389]: query_name_response: Multiple (2) responses received for a query on subnet 192.168.0.2 for name HOME<1d>. Nov 28 13:22:35 tcn nmbd[4389]: This response was from IP 192.168.0.3, reporting an IP address of 192.168.0.3. Nov 28 13:22:42 tcn SuSEfirewall2: Warning: FW_ALLOW_INCOMING_HIGHPORTS_UDP=DNS no longer supported Nov 28 13:22:42 tcn SuSEfirewall2: Firewall rules successfully set from /etc/sysconfig/SuSEfirewall2 but could not reproduce it. 192.168.0.3 is the Windows machine.

nmap -p 139,145 <ip> and

Starting nmap 3.48 ( http://www.insecure.org/nmap/ ) at 2004-11-28 13:32 CET Interesting ports on tcn.local (192.168.0.2): PORT STATE SERVICE 139/tcp open netbios-ssn 445/tcp open microsoft-ds

nmap -sU -p 137,138 <ip>

Starting nmap 3.48 ( http://www.insecure.org/nmap/ ) at 2004-11-28 13:33 CET Interesting ports on 192.168.0.3: PORT STATE SERVICE 137/udp open netbios-ns 138/udp open netbios-dgm

smbclient -L <ip> shows shares

Password: Domain=[HOME] OS=[Unix] Server=[Samba 3.0.7-5.2-SUSE] Sharename Type Comment --------- ---- ------- IPC$ IPC IPC Service (tcn) ADMIN$ IPC IPC Service (tcn) Domain=[HOME] OS=[Unix] Server=[Samba 3.0.7-5.2-SUSE] Server Comment --------- ------- TCN tcn Workgroup Master --------- ------- HOME For the Windows machine I get: session request to 192.168.0.3 failed (Called name not present) session request to 192 failed (Called name not present) ?

nmbclient -A <ip> shows netbiosnames

Hmm, seems I don't have nmbclient...

but 192.168.0.255 is a strange IP for a router.

You are right, it's 192.168.0.1 :-)

Type ipconfig in windows commandprompt to see what settings the windowsbox got from dhcp.

192.168.0.3

On Sunday 28 November 2004 18:52, you wrote:

sure you dont, its called nmblookup :-) my fault so try nmblookup -A -<ip> and nmblookup <nbname>

-A works fine, nbname works only for the linux box, not for the Windows machine: # nmblookup -A 192.168.0.2 Looking up status of 192.168.0.2 TCN <00> - B <ACTIVE> TCN <03> - B <ACTIVE> TCN <20> - B <ACTIVE> HOME <00> - <GROUP> B <ACTIVE> HOME <1e> - <GROUP> B <ACTIVE> MAC Address = 00-00-00-00-00-00 # nmblookup -A 192.168.0.3 Looking up status of 192.168.0.3 AUDIOWERK <00> - M <ACTIVE> AUDIOWERK <20> - M <ACTIVE> HOME <00> - <GROUP> M <ACTIVE> HOME <1e> - <GROUP> M <ACTIVE> HOME <1d> - M <ACTIVE> ..__MSBROWSE__. <01> - <GROUP> M <ACTIVE> MAC Address = 00-0E-35-11-C0-B0 # nmblookup tcn querying tcn on 192.168.0.255 192.168.0.2 tcn<00> # nmblookup audiowerk querying audiowerk on 192.168.0.255 name_query failed to find name audiowerk

so the ports are reachable with running firewall but you only reach the windowsshares without firewall on linux but windows can connetct to sambashares anyhow?

No I cannot access my linux shares from the Windows machine either...