Mailinglist Archive: opensuse (3337 mails)

< Previous Next >
Re: [SLE] Samba Firewall Issue with Allowing Highports
  • From: Andres Mejia <mcitadel@xxxxxxxxx>
  • Date: Sun, 23 Apr 2006 18:59:16 -0400
  • Message-id: <200604231859.16961.mcitadel@xxxxxxxxx>
Here's what I got. I placed it in an attachment.

On Sunday 23 April 2006 18:32, Darryl Gregorash wrote:
> On 23/04/06 13:43, Andres Mejia wrote:
> >SFW2-INext-DROP-DEFLT IN=eth0 OUT=
> >MAC=00:10:b5:8d:af:fb:00:0c:6e:63:11:af:08:00 SRC=192.168.0.2
> >DST=192.168.0.101 LEN=90 TOS=0x00 PREC=0x00 TTL=64 ID=139 DF PROTO=UDP
> >SPT=137 DPT=1028 LEN=70
> >
> >Packets were being dropped because of the destination ports that were
> > being chosen. Here you see DPT=1028, but I saw ports being randomly
> > picked between 1024 and 1030.
>
> You've never said which machine this was taken from, but I am certain it
> is from your client machine. It is also a unicast packet, so it is
> certainly in response to something else that was already sent by that
> machine -- a samba server simply just does not emit an arbitrary unicast
> message on port 137 with some arbitrary port as the destination.
>
> It is absolutely impossible to know why any particular network packet
> was dropped without knowing all the details of the firewall
> configuration. What do you get from running this on the client machine:
>
> iptables-save |grep -i input_ext
linux:~ # iptables-save |grep -i input_ext
:input_ext - [0:0]
-A INPUT -i eth0 -j input_ext
-A INPUT -j input_ext
-A input_ext -p udp -m pkttype --pkt-type broadcast -m udp --dport 137 -j ACCEPT
-A input_ext -p udp -m pkttype --pkt-type broadcast -m udp --dport 138 -j ACCEPT
-A input_ext -p udp -m pkttype --pkt-type broadcast -m udp --dport 631 -j ACCEPT
-A input_ext -m pkttype --pkt-type broadcast -j DROP
-A input_ext -p icmp -m icmp --icmp-type 4 -j ACCEPT
-A input_ext -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A input_ext -p icmp -m state --state RELATED,ESTABLISHED -m icmp --icmp-type 0 -j ACCEPT
-A input_ext -p icmp -m state --state RELATED,ESTABLISHED -m icmp --icmp-type 3 -j ACCEPT
-A input_ext -p icmp -m state --state RELATED,ESTABLISHED -m icmp --icmp-type 11 -j ACCEPT
-A input_ext -p icmp -m state --state RELATED,ESTABLISHED -m icmp --icmp-type 12 -j ACCEPT
-A input_ext -p icmp -m state --state RELATED,ESTABLISHED -m icmp --icmp-type 14 -j ACCEPT
-A input_ext -p icmp -m state --state RELATED,ESTABLISHED -m icmp --icmp-type 18 -j ACCEPT
-A input_ext -p icmp -m state --state RELATED,ESTABLISHED -m icmp --icmp-type 3/2 -j ACCEPT
-A input_ext -p icmp -m state --state RELATED,ESTABLISHED -m icmp --icmp-type 5 -j ACCEPT
-A input_ext -s 192.168.0.0/255.255.255.0 -m limit --limit 3/min -m state --state NEW -j LOG --log-prefix "SFW2-INext-ACC-TRUST " --log-tcp-options --log-ip-options
-A input_ext -s 192.168.0.0/255.255.255.0 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A input_ext -p tcp -m limit --limit 3/min -m tcp --dport 50000:65535 --tcp-flags FIN,SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-ACC-TCP " --log-tcp-options --log-ip-options
-A input_ext -p tcp -m tcp --dport 50000:65535 -j ACCEPT
-A input_ext -p tcp -m limit --limit 3/min -m tcp --dport 135 --tcp-flags FIN,SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-ACC-TCP " --log-tcp-options --log-ip-options
-A input_ext -p tcp -m tcp --dport 135 -j ACCEPT
-A input_ext -p tcp -m limit --limit 3/min -m tcp --dport 631 --tcp-flags FIN,SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-ACC-TCP " --log-tcp-options --log-ip-options
-A input_ext -p tcp -m tcp --dport 631 -j ACCEPT
-A input_ext -p tcp -m limit --limit 3/min -m tcp --dport 445 --tcp-flags FIN,SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-ACC-TCP " --log-tcp-options --log-ip-options
-A input_ext -p tcp -m tcp --dport 445 -j ACCEPT
-A input_ext -p tcp -m limit --limit 3/min -m tcp --dport 139 --tcp-flags FIN,SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-ACC-TCP " --log-tcp-options --log-ip-options
-A input_ext -p tcp -m tcp --dport 139 -j ACCEPT
-A input_ext -p udp -m udp --dport 50000:65535 -j ACCEPT
-A input_ext -p udp -m udp --dport 631 -j ACCEPT
-A input_ext -p udp -m udp --dport 138 -j ACCEPT
-A input_ext -p udp -m udp --dport 137 -j ACCEPT
-A input_ext -p tcp -m tcp --dport 113 -m state --state NEW -j reject_func
-A input_ext -p tcp -m limit --limit 3/min -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j LOG --log-prefix "SFW2-INext-DROP-DEFLT " --log-tcp-options --log-ip-options
-A input_ext -p icmp -m limit --limit 3/min -j LOG --log-prefix "SFW2-INext-DROP-DEFLT " --log-tcp-options --log-ip-options
-A input_ext -p udp -m limit --limit 3/min -j LOG --log-prefix "SFW2-INext-DROP-DEFLT " --log-tcp-options --log-ip-options
-A input_ext -m limit --limit 3/min -m state --state INVALID -j LOG --log-prefix "SFW2-INext-DROP-DEFLT-INV " --log-tcp-options --log-ip-options
-A input_ext -j DROP
< Previous Next >
Follow Ups