Why does iptables still block my samba?

Question

I'm currently fighting with iptables and samba.

I read that samba needs ports 137-139 and 445 open on both tcp and udp.

Here is the relevant part of my iptables config

...
# forward valid incoming connections from lan to lan-services chain
-A INPUT -i eth1 -s 192.168.17.0/24 -p udp -m conntrack --ctstate NEW -j LANSERV
-A INPUT -i eth1 -s 192.168.17.0/24 -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m conntrack --ctstate NEW -j LANSERV
...
# samba
-A LANSERV -p tcp -m tcp --sport 137:139 --dport 137:139 -j ACCEPT
-A LANSERV -p udp -m udp --sport 137:139 --dport 137:139 -j ACCEPT
-A LANSERV -p tcp -m tcp --sport 445 --dport 445 -j ACCEPT
-A LANSERV -p udp -m udp --sport 445 --dport 445 -j ACCEPT

okay, 192.168.17.* is my local subnet which is connected to eth1. What is wrong with these rules? Does samba need even more ports?

It is definetly the firewall since adding -A INPUT -i eth1 -s 192.168.17.0/24 -j ACCEPT on top makes samba work.

edit: I'm trying to connect from a Windows 7 machine.

Answer 1

The "source port" means the port the remote machine sent the packet to your server from. Rarely, if ever, are client-to-server packets sent from the same remote port that they arrive on. This is due to the restriction in most OSes that dictate that normal users cannot open ports below a certain limit (in Linux it's any port below 1024).

Hence, the source port of the packets being directed to your machine are most likely coming from a random, high-numbered port on the remote host. In essence, the port number doesn't really matter and may as well not be specified.

The rule above expected packets to come from the remote port 137-139 and doesn't catch them if they don't. Remove the --sport 137:139 and it should accept traffic to your port 137-139 from a remote machine's random high port.