After I set up iptables INPUT policy to DROP on my desktop, my samba client there stoped working. I can understand that the samba server has to have some incoming ports opened, but why does client need it? And what ports does it need? All the advice I can find regarding firewall ports and samba are for server - does it apply to client too?

If I set INPUT policy to ACCEPT, then samba client is working again, so the problem has to be in the iptables config and also everything else on the desktop seems to be working ok. My relevant iptables settings:

-A INPUT -i lo -j ACCEPT
-A INPUT -d ! -i lo -j REJECT --reject-with icmp-port-unreachable
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
  • 1
    Are you using DNS / IP addresses, or are you relying on legacy NBT for name resolution?
    – sourcejedi
    Mar 23, 2017 at 9:29
  • attach your rules with iptables-save
    – daisy
    Mar 23, 2017 at 9:30
  • 1
    To debug just add -j LOG type rule as the last INPUT chain rule to see packets going to be dropped.
    – VPfB
    Mar 23, 2017 at 9:32
  • If the traffic is dropped in the INPUT chain you won't get any response. You can allow the local range i.e on the INPUT chain Mar 23, 2017 at 9:36
  • 1
    @sourcejedi I though that I'm using dns, but to my surprise when I used the raw IP address instead of server name, the log was quite different (much better looking) ending with NT_STATUS_LOGON_FAILURE instead of NT_STATUS_UNSUCCESSFUL. Maybe I was just unknowingly used NBT name resolution before. However despite the different debug log and error messages the behavior stays the same - DROP policy = no connection, ACCEPT policy = connection ok. Mar 23, 2017 at 10:18


You must log in to answer this question.

Browse other questions tagged .