Hello!

I have been reading here a lot and finally registered since I didn't find an answer to my question.

We have the following setup: A linux software router/firewall running SuSe and 9 machines using it to access the net. Some of these machines are DualOS (Linux/Win) machines and I want to prevent internet access if the machines boot into windows. My idea right now is, since we do not use DHCP, to give a different IP to the machine if it boots into Windows and easily block access for these IPs.

I would rather have it another way though. Is there any way to make an ipchains script / rule that detects if a machine is broadcasting on any ports 137-139 and then block internet access for a given amout of minutes?

Thanks in advance for you help

Sebastian

Given that you are the admin you could remove the TCP/IP support from all windows machines. That way there would be no netting at all...

Linux would naturally be uninfluenced by this.

You could set up portsentry on the inward facing interface, add port 139 to its list of "evil ports" and watch it drop those boxes from the routing table :-)

Thanks a lot. Just the thing I was looking for

can't one also use iptables for this purpose?

Not in the same way.

You can basically tell port sentry to ignore boxes outputting on certain ports.

You could implement the same sort of functionality with iptables and much scripting, most likely involving netcat. but that really would be making life difficult.