[Samba] Not another SAMBA through a firewall post

[randalls at bioinfo.wsu.edu]

Kevin,

Thanks for the response. I was kind of thinking along the same lines as what you described.  I disabled the second NIC and every samba started working through the firewall.  I even wrote a simple perl socket server and made the same observations as I did with Samba.  

Thanks,

Randall Svancara



----- Original Message -----
From: "Kevin Keane" <subscription at kkeane.com>
To: samba at lists.samba.org
Sent: Friday, March 5, 2010 7:18:06 PM
Subject: Re: [Samba] Not another SAMBA through a firewall post

I think part of your problem is that both of your NICs are on the same subnet. That will usually cause headaches; it confuses the routing table. It is entirely possible that Samba responds from IP 10.0.0.246 even when the connection goes to .245 - and you don't have firewall rules for that. Note that the interfaces statement isn't necessarily going to help - you should actually shut down the second NIC (ifdown eth1) to have it completely removed from Linux.

Also, at least for testing, I would also simplify the setup - only use port 445, and only tcp. That way, you only have to debug one rule instead of eight. Use telnet to test if you can reach the Samba server from the outside world. Also, only use UDP and TCP, not both. 137 and 138 should be UDP; 139 and 445 should be TCP. 

> -----Original Message-----
> From: samba-bounces at lists.samba.org [mailto:samba-
> bounces at lists.samba.org] On Behalf Of randalls at bioinfo.wsu.edu
> Sent: Friday, March 05, 2010 1:42 PM
> To: samba at lists.samba.org
> Subject: [Samba] Not another SAMBA through a firewall post
> 
> I suppose a few questions pop up on this list about access Samba
> through a firewall.  I have been very successful running Samba through
> a firewall, until today.  I hit a stumbling block.
> 
> I have a Linux Firewall with the public IP Address of 134.x.x.140 <it
> is not the exact ip address, but close>.  I am using NAT and port
> forwarding to send traffic destined for 137, 138,139, and 445 for BOTH
> TCP and IP to an internal host of 10.0.0.245.  This internal host has
> two network interface cards, 10.0.0.245 and 10.0.0.246.
> 
> Here are my firewall rules:
> 
>   $IPTABLES -A PREROUTING -t nat -i $EXTIF -p tcp --dport 137 -d
> 134.x.x.140 -j DNAT --to-destination 10.0.0.245:137
>   $IPTABLES -A PREROUTING -t nat -i $EXTIF -p udp --dport 137 -d
> 134.x.x.140 -j DNAT --to-destination 10.0.0.245:137
> 
>   $IPTABLES -A PREROUTING -t nat -i $EXTIF -p tcp --dport 138 -d
> 134.x.x.140 -j DNAT --to-destination 10.0.0.245:138
>   $IPTABLES -A PREROUTING -t nat -i $EXTIF -p udp --dport 138 -d
> 134.x.x.140 -j DNAT --to-destination 10.0.0.245:138
> 
>   $IPTABLES -A PREROUTING -t nat -i $EXTIF -p tcp --dport 139 -d
> 134.x.x.140 -j DNAT --to-destination 10.0.0.245:139
>   $IPTABLES -A PREROUTING -t nat -i $EXTIF -p udp --dport 139 -d
> 134.x.x.140 -j DNAT --to-destination 10.0.0.245:139
> 
>   $IPTABLES -A PREROUTING -t nat -i $EXTIF -p tcp --dport 445 -d
> 134.x.x.140 -j DNAT --to-destination 10.0.0.245:445
>   $IPTABLES -A PREROUTING -t nat -i $EXTIF -p udp --dport 445 -d
> 134.x.x.140 -j DNAT --to-destination 10.0.0.245:445
> 
>   $IPTABLES -t nat -A POSTROUTING -o eth0 -p tcp -s 10.0.0.245 -j SNAT
> --to-source 134.x.x.140
>   $IPTABLES -t nat -A POSTROUTING -o eth0 -p udp -s 10.0.0.245 -j SNAT
> --to-source 134.x.x.140
>   $IPTABLES -t nat -A POSTROUTING -o eth0 -p tcp -s 10.0.0.245 -j SNAT
> --to-source 134.x.x.140
>   $IPTABLES -t nat -A POSTROUTING -o eth0 -p udp -s 10.0.0.245 -j SNAT
> --to-source 134.x.x.140
> 
> When I have both network cards activated, I am unable to access SAMBA
> through the firewall.  However, I can access them on the local LAN.  I
> try to tell Samba to use eth0 and lo using:
> 
> interfaces = lo eth0
> bind interfaces only = yes
> 
> Still does not work.  I can use tcpdump -i eth0 and I can packets going
> through the firewall:
> 13:36:10.904331 IP 134.x.x.19.34251 > 10.0.0.245.139: S
> 2273296206:2273296206(0) win 5840 <mss 1460,sackOK,timestamp 4731872
> 0,nop,wscale 7>
> 
> And also I can see the requests arriving on eth0 on the Samba server:
> 13:35:55.777985 IP 134.x.x.19.34251 > 10.0.0.245.139: Flags [S], seq
> 2273296206, win 5840, options [mss 1460,sackOK,TS val 4731872 ecr
> 0,nop,wscale 7], length 0
> 
> I am at a loss as to why this is happening.  Anyone care to enlighten
> me?
> 
> Randall Svancara
> 
> 
> 
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba