Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I'm currently fighting with iptables and samba.

I read that samba needs ports 137-139 and 445 open on both tcp and udp.

Here is the relevant part of my iptables config

...
# forward valid incoming connections from lan to lan-services chain
-A INPUT -i eth1 -s 192.168.17.0/24 -p udp -m conntrack --ctstate NEW -j LANSERV
-A INPUT -i eth1 -s 192.168.17.0/24 -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m conntrack --ctstate NEW -j LANSERV
...
# samba
-A LANSERV -p tcp -m tcp --sport 137:139 --dport 137:139 -j ACCEPT
-A LANSERV -p udp -m udp --sport 137:139 --dport 137:139 -j ACCEPT
-A LANSERV -p tcp -m tcp --sport 445 --dport 445 -j ACCEPT
-A LANSERV -p udp -m udp --sport 445 --dport 445 -j ACCEPT

okay, 192.168.17.* is my local subnet which is connected to eth1. What is wrong with these rules? Does samba need even more ports?

It is definetly the firewall since adding -A INPUT -i eth1 -s 192.168.17.0/24 -j ACCEPT on top makes samba work.

edit: I'm trying to connect from a Windows 7 machine.

share|improve this question
add comment

1 Answer 1

up vote 6 down vote accepted

The "source port" means the port the remote machine sent the packet to your server from. Rarely, if ever, are client-to-server packets sent from the same remote port that they arrive on. This is due to the restriction in most OSes that dictate that normal users cannot open ports below a certain limit (in Linux it's any port below 1024).

Hence, the source port of the packets being directed to your machine are most likely coming from a random, high-numbered port on the remote host. In essence, the port number doesn't really matter and may as well not be specified.

The rule above expected packets to come from the remote port 137-139 and doesn't catch them if they don't. Remove the --sport 137:139 and it should accept traffic to your port 137-139 from a remote machine's random high port.

share|improve this answer
1  
omg thats really it? :/ well thank you. I'll accept the answer as soon as I'm able to test it. –  unR Aug 18 '11 at 9:39
1  
it worked, accepted. –  unR Aug 19 '11 at 7:33
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.