Hi, I am wondering why I can't block packets coming in on udp ports 137 and 138 in iptables?

I have a win client that uses udp broadcasts to resolve netbios names. I thought it used udp port 138 for this but when I block it with iptables, name resolution still works:

-A RH-Lokkit-0-50-INPUT -p udp -m udp --dport 0:1023 -j REJECT

Also, doesn't nmbd listen on port 137? How can clients send it browsing information if packets are set to be rejected in the firewall? When you open up network neighbourhood, does not this list come from nmbd? How can nmbd respond if packets don't reach the port because of the firewall rule?

Maybe I don't understand the mechanism.

Darryl

The smb protocol uses ports 137, 138 and 139. It also uses tcp as well as udp so you will need to close both.

But I thought all name resolution was done by udp. If I type, net use * \\<samba server hostname> on my windows client, wouldn't the name resolution request go to nmbd on a udp port on my samba server. If I have all of these ports closed on the firewall, why does name resolution work. The netbios cache or whatever it is called is empty on my windows box.

I am just curious.


Darryl

UDP is the primary protocol for name resolution but I think it will revert to tcp if it fails on udp.

OK, I found out what is going on. I had an entry for my samba server in the lmhosts file on my windows box. It was not even going to the server for name resolution. Now if I block udp port 137, the port that nmbd is listening on, name resolution does not work and everything makes sense.