How do I configure firewall for SAMBA?

drwolfson · 11-04-2003, 10:04 AM

I seem to have become the admistrator for a RH9 machine at work which is mainly used as a print/file server. So far it seems to be far more succesful than it's previous window incarnation (people can actually print and get to their files!) but as a newbie I'm having trouble setting up the firewall (it's currently off

). I need to set it up to allow SAMBA users through and I know I need to change the iptables to do it (as someone had sucessfully done this for me before I started tinkering) but I'm not sure how/what to. I've been looking round a few user groups and it seems that other people have had this type of problem, but I can't find a straight answer to it. Any suggestions?

Thanks,

DW

peter_robb · 11-04-2003, 10:18 AM

I have to ask why you want a firewall on it..

If all it does is file/print serving, it can be considered to be in a trusted network and so long as the unnecessary services on it are all turned off, it can be secure enough.

If someone directs ports from the internet to it, then yes it needs a firewall.

SMB uses udp ports 137&138, and tcp ports 139&445.
Also make sure udp port 53 is open for dns.

A good GUI tool is Firestarter

drwolfson · 11-04-2003, 10:32 AM

I've got the firewall up as we do have internet users, and some confidential data stored on it. Otherwise, I'd not bother!
Since posting this I've had some advice from a more local source who recomended the following commands:

iptables -I RH-Lokkit-0-50-INPUT -p udp --dport 137:138 -j ACCEPT
iptables -I RH-Lokkit-0-50-INPUT -p tcp --dport 139 -j ACCEPT

which seem to have worked. Is this a good solution, or would you recomend something else?

DW

peter_robb · 11-04-2003, 10:47 AM

Well, that lets anyone into the server...

You may want to add some form of ip control to select who is ok and drop the rest.

eg
iptables -I RH-Lokkit-0-50-INPUT -s my.friends.ip.address -p udp --dport 137:138 -j ACCEPT
iptables -I RH-Lokkit-0-50-INPUT -s my.friends.ip.address -p tcp --dport 139 -j ACCEPT

drwolfson · 11-05-2003, 06:05 AM

We have fairly restircted user list anyway so I'm not worried about letting any of them access this way. I think this is problem sloved... Thanks for your help,

DW (a linux convert)