iptables and SMB for one public address

a2782d4 · 04-10-2009, 02:41 AM

I'm trying to config a public web server to SMB so my local windows users and hit the share. the server has a public address, I would like to say in the iptables to only accept traffic on the lan address..

I'm a bit lost I would i do that? Any help would be wonderful!

#SMB share
-A RH-Firewall-1-INPUT -p udp -m udp -s 64.451.207.181 --dport 137 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp -d 64.451.207.181 --dport 138 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp -d 64.451.207.181 --dport 139 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp -d 64.451.207.181 --dport 445 -j ACCEPT

blacky_5251 · 05-03-2009, 06:58 PM

Firstly, I am assuming your default iptables setting is to DROP packets that are not ACCEPTed by one of your rules. So, all you need to do is define rules that accept LAN traffic, and everything else will be dropped.

Also, I have assumed your lan traffic comes from ip range 192.168.0.x.

Code:

-A RH-Firewall-1-INPUT -m state --state NEW -s 192.168.0.0/24 -m udp -p udp --dport 137 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -s 192.168.0.0/24 -m udp -p udp --dport 138 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -s 192.168.0.0/24 -m tcp -p tcp --dport 139 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -s 192.168.0.0/24 -m tcp -p tcp --dport 445 -j ACCEPT