0

I previously ACCEPTed all output traffic by default. Recently changed the policy to DENY output by default, only opening ports needed for server/application functionality.

When I tried to mount a drive this morning, there was a timeout (the destination server is up). If I set the output policy to ACCEPT, I'm able to mount without issue.

I've added the following rules to my firewall:

Chain INPUT (policy DROP 166 packets, 49616 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp spt:137 state NEW,ESTABLISHED 
  628 48984 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp spt:137 state NEW,ESTABLISHED 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp spt:138 state NEW,ESTABLISHED 
   32  7244 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp spt:138 state NEW,ESTABLISHED 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp spt:139 state NEW,ESTABLISHED 
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp spt:139 state NEW,ESTABLISHED

Chain OUTPUT (policy DROP 30 packets, 1800 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:137 state NEW,ESTABLISHED 
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpt:137 state NEW,ESTABLISHED 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:138 state NEW,ESTABLISHED 
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpt:138 state NEW,ESTABLISHED 
    3   180 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:139 state NEW,ESTABLISHED 
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpt:139 state NEW,ESTABLISHED 

By temporarily setting output to ACCEPT, I generated some INPUT traffic on ports udp:137, udp:138. I see some OUPUT traffic on tcp:139.

The second I change default output to DENY, I get timeouts again.

Here's the /etc/fstab line:

//example.com/shares/acoder /mnt/acoder cifs credentials=/etc/credfile,dom=example,uid=0,gid=0,file_mode=0600,dir_mode=0700 0 0 0 0

In the example above, //example.com/shares/acoder is a Windows server.

Here's the relevant portion of /etc/services

# grep -i NETBIOS /etc/services 
netbios-ns      137/tcp                         # NETBIOS Name Service
netbios-ns      137/udp
netbios-dgm     138/tcp                         # NETBIOS Datagram Service
netbios-dgm     138/udp
netbios-ssn     139/tcp                         # NETBIOS session service
netbios-ssn     139/udp

What other port(s) need to be open for mounting with cifs?

  • In general, if you want to see what network traffic is hitting a chain's default policy having a iptables -I ChainName -j LOG will help you figure that out which will in turn let you know which ports to open up. For example, in your case iptables -I INPUT -j LOG and iptables -I INPUT -j LOG – Bratchley Apr 3 '15 at 14:39
  • Did you mean iptables -I INPUT -j LOG and iptables -I OUTPUT -j LOG? – a coder Apr 3 '15 at 14:45
  • Er yeah, I guess that's what I get for copying and pasting. – Bratchley Apr 3 '15 at 14:53
2

You also need port 445 and make sure that you also have incoming related/established traffic allowed.

grep 445 /etc/services
microsoft-ds    445/tcp             # Microsoft Naked CIFS
microsoft-ds    445/udp

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.