0

I previously ACCEPTed all output traffic by default. Recently changed the policy to DENY output by default, only opening ports needed for server/application functionality.

When I tried to mount a drive this morning, there was a timeout (the destination server is up). If I set the output policy to ACCEPT, I'm able to mount without issue.

I've added the following rules to my firewall:

Chain INPUT (policy DROP 166 packets, 49616 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp spt:137 state NEW,ESTABLISHED 
  628 48984 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp spt:137 state NEW,ESTABLISHED 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp spt:138 state NEW,ESTABLISHED 
   32  7244 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp spt:138 state NEW,ESTABLISHED 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp spt:139 state NEW,ESTABLISHED 
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp spt:139 state NEW,ESTABLISHED

Chain OUTPUT (policy DROP 30 packets, 1800 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:137 state NEW,ESTABLISHED 
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpt:137 state NEW,ESTABLISHED 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:138 state NEW,ESTABLISHED 
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpt:138 state NEW,ESTABLISHED 
    3   180 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:139 state NEW,ESTABLISHED 
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpt:139 state NEW,ESTABLISHED

By temporarily setting output to ACCEPT, I generated some INPUT traffic on ports udp:137, udp:138. I see some OUPUT traffic on tcp:139.

The second I change default output to DENY, I get timeouts again.

Here's the /etc/fstab line:

//example.com/shares/acoder /mnt/acoder cifs credentials=/etc/credfile,dom=example,uid=0,gid=0,file_mode=0600,dir_mode=0700 0 0 0 0

In the example above, //example.com/shares/acoder is a Windows server.

Here's the relevant portion of /etc/services

# grep -i NETBIOS /etc/services 
netbios-ns      137/tcp                         # NETBIOS Name Service
netbios-ns      137/udp
netbios-dgm     138/tcp                         # NETBIOS Datagram Service
netbios-dgm     138/udp
netbios-ssn     139/tcp                         # NETBIOS session service
netbios-ssn     139/udp

What other port(s) need to be open for mounting with cifs?

Improve this question
3
  • In general, if you want to see what network traffic is hitting a chain's default policy having a iptables -I ChainName -j LOG will help you figure that out which will in turn let you know which ports to open up. For example, in your case iptables -I INPUT -j LOG and iptables -I INPUT -j LOG
    – Bratchley
    Apr 3, 2015 at 14:39
  • Did you mean iptables -I INPUT -j LOG and iptables -I OUTPUT -j LOG?
    – a coder
    Apr 3, 2015 at 14:45
  • Er yeah, I guess that's what I get for copying and pasting.
    – Bratchley
    Apr 3, 2015 at 14:53

1 Answer 1

Reset to default
2

You also need port 445 and make sure that you also have incoming related/established traffic allowed.

grep 445 /etc/services
microsoft-ds    445/tcp             # Microsoft Naked CIFS
microsoft-ds    445/udp
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .