Hi, after some time of looking into FW logs I found that the problem was (how easy to find, when a man knows what to look for:). From /var/log/messages Sep 10 20:15:03 nganga kernel: SFW2-INext-DROP-DEFLT IN=eth0 OUT= MAC=00:06:5b:dd:a2:9d:00:60:52:06:97:20:08:00 SRC=157.218.65.59 DST=157.218.65.109 LEN=90 TOS=0x00 PREC=0x00 TTL=128 ID=50979 PROTO=UDP SPT=137 DPT=2676 LEN=70 is clearly seen that master browser (157.218.65.59) send a UDP packet to my box on a port 2676. After enabling FW_SERVICES_EXT_UDP="137 138 2676" then I have got correct answer # nmblookup -M KFY querying KFY on 147.228.55.255 Got a positive name query response from 147.228.55.59 ( 147.228.55.59 ) 147.228.55.59 KFY<1d> That is for future when someone will have the same problems. But still I have a question why is this necesary? I couldn't find this setting anywhere. Is it a security problem? Thank you Stepan