jeffreybluml

[Log in to get rid of this advertisement]

Hi,

Just closed a really long thread trying to get my linux box's printer installed on my networked wondows box, and after days of fighting I found out my linux firewall was what was holding me back. Once I disabled the firewall, I am able to browse my linux box from windows. Cant print yet (though I was able to find and install the printer from windows...just doesn't actually print when asked) but I can browse and write from windows to linux.

Currently, I have my firewall disabled still. I am behind a linksys router, but I'm running a webserver and sshd on my linux box, so I'd be more comfortable if I had the firewall up. I had tried to open ports 137, 138, and 139 through iptables, but have NO idea if I did it correctly. These are in fact the ports needed for windows to unix samba sharing, aren't they? Here's my iptables, into which I manually entered the lines for the aforementioned ports:

Oops, iptables is now gone from /etc/sysconfig!!!!! Is that because the firewall is disabled? I'll assume so. Here is what it said when it was up:


------------------------------------------------------------------------------------------------
# Firewall configuration written by redhat-config-securitylevel
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p 50 -j ACCEPT
-A RH-Firewall-1-INPUT -p 51 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 137 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 138 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 139 -j ACCEPT
COMMIT
-----------------------------------------------------------------------------------------------


I really assume I entered the lines for ports 137-139 wrong. I just copied the line for port 80, which I realize isn't the correct way to do it.

Will somebody please let me know how to PROPERLY open the needed ports for samba sharing? What ports, and what command opens them?

THanks!

hazza

The last three rules will not match anything because the fourth last line rejects everything. As for what are the correct ports use "netstat -lnptuw" to find out what samba is listening on and open them up. Move the fourth last rule to the bottom.

The ports that samba listens on are 137/udp, 138/udp, 139/tcp and 445/tcp. I would suggest not editing /etc/sysconfig/iptables directlly is hazardous as one mistake can leave you without a firewall. It is better to modify it with the iptables command and save it with "service iptables save".

jeffreybluml

Thanks for the reply...

I am running fedora core 1, and both "iptables" and "service" give "command not found"

Is there another command I can use? I am not at home, but can do most by ssh. How would a person start (or restart) his firewall via command line if typing service gives command not found?

THanks,

hazza

Having both iptables and service turn up as not found would mean that /sbin is not in your path. You have to run them as root but somethimes using su to login as root doesn't set the path. So if they're not in you path then use "/sbin/iptables" and "/sbin/service". If you login in as root using "su -l" it should setup the PATH variable for you properly.

hazza

Considering the configuration you've described here's one way to setup your firewall:

Clear out the old firewall by running the following as root:

# /sbin/iptables -F
# /sbin/iptables -X

Setup the new firewall:

# /sbin/iptables -A INPUT -j ACCEPT -i lo
# /sbin/iptables -A INPUT -j ACCEPT -m state --state ESTABLISHED,RELATED
# /sbin/iptables -A INPUT -j ACCEPT -m state --state NEW -p icmp --icmp-type echo-request
# /sbin/iptables -A INPUT -j ACCEPT -m state --state NEW -p tcp --dport 22 --syn
# /sbin/iptables -A INPUT -j ACCEPT -m state --state NEW -p tcp --dport 80 --syn
# /sbin/iptables -A INPUT -j ACCEPT -m state --state NEW -p udp --dport 137
# /sbin/iptables -A INPUT -j ACCEPT -m state --state NEW -p udp --dport 138
# /sbin/iptables -A INPUT -j ACCEPT -m state --state NEW -p tcp --dport 139 --syn
# /sbin/iptables -A INPUT -j ACCEPT -m state --state NEW -p tcp --dport 445 --syn
# /sbin/iptables -A INPUT -j REJECT -p tcp --reject-with tcp-reset
# /sbin/iptables -A INPUT -j REJECT -p udp --reject-with icmp-port-unreachable
# /sbin/iptables -P INPUT DROP
# /sbin/iptables -P FORWARD DROP
# /sbin/iptables -P OUTPUT ACCEPT

Add the following line to /etc/sysconfig/network to stop the scripts from modifying your custom firewall:

FIREWALL_MODS=no

Finally you save your firewall configuration to /etc/sysconfig/iptables and enable it with:

# /sbin/service iptables save
# /sbin/chkconfig iptables on

jeffreybluml

hazza! I cannot thank you enough! That is exactly the kind of help (or handholding) I needed!

Not home, so now way of konwing if it worked, but it let me enter all the commands, and started the service okay, so I'll assume for now that it did.

How can I add sbin to my path? I'd like it done for all users, so which file do I put it in and what do I put there?

Thanks again, you are a very good person...

Gotta love LQ...

jeffreybluml

Come to think of it, can somebody please outline for me the following:

1) In what file(s) does one define the paths that will be used for finding commands?

2) What are ALL the paths that should be listed there? If sbin is not in my path (which apparently it isn't), I assume there may be other paths not listed as well, so can somebody give me an example of all the useful paths?

Thanks in advance!