I previously ACCEPTed all output traffic by default. Recently changed the policy to DENY output by default, only opening ports needed for server/application functionality.
When I tried to mount a drive this morning, there was a timeout (the destination server is up). If I set the output policy to ACCEPT, I'm able to mount without issue.
I've added the following rules to my firewall:
Chain INPUT (policy DROP 166 packets, 49616 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:137 state NEW,ESTABLISHED
628 48984 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spt:137 state NEW,ESTABLISHED
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:138 state NEW,ESTABLISHED
32 7244 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spt:138 state NEW,ESTABLISHED
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:139 state NEW,ESTABLISHED
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spt:139 state NEW,ESTABLISHED
Chain OUTPUT (policy DROP 30 packets, 1800 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:137 state NEW,ESTABLISHED
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:137 state NEW,ESTABLISHED
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:138 state NEW,ESTABLISHED
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:138 state NEW,ESTABLISHED
3 180 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:139 state NEW,ESTABLISHED
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:139 state NEW,ESTABLISHED
By temporarily setting output to ACCEPT, I generated some INPUT traffic on ports udp:137, udp:138. I see some OUPUT traffic on tcp:139.
The second I change default output to DENY, I get timeouts again.
Here's the /etc/fstab
line:
//example.com/shares/acoder /mnt/acoder cifs credentials=/etc/credfile,dom=example,uid=0,gid=0,file_mode=0600,dir_mode=0700 0 0 0 0
In the example above, //example.com/shares/acoder is a Windows server.
Here's the relevant portion of /etc/services
# grep -i NETBIOS /etc/services
netbios-ns 137/tcp # NETBIOS Name Service
netbios-ns 137/udp
netbios-dgm 138/tcp # NETBIOS Datagram Service
netbios-dgm 138/udp
netbios-ssn 139/tcp # NETBIOS session service
netbios-ssn 139/udp
What other port(s) need to be open for mounting with cifs
?
iptables -I ChainName -j LOG
will help you figure that out which will in turn let you know which ports to open up. For example, in your caseiptables -I INPUT -j LOG
andiptables -I INPUT -j LOG
iptables -I INPUT -j LOG
andiptables -I OUTPUT -j LOG
?