0

i'am working on securing my lamp server(debian 9) with iptables.

well as you probebly know. the principle is to block all ports and then allow only the ones i need.

for the moment i've succeeded on opening pretty much all of the ports i need such as ssh, http/https, icmp, dns, smtp, mysql...

however my lamp server needs to mount two windows shares from windows sever using CIFS like

mount -t cifs -o user=user,rw //<ip adresse> /share1 /var/share1

it worked just fine before setting up iptables, i tried to open tcp and udp ports 137 138 139 445 using iptables commandes

------ INPUT

--------------udp

iptables -t filter -A INPUT -p udp --dport 137 -j ACCEPT

iptables -t filter -A INPUT -p udp --dport 139 -j ACCEPT

iptables -t filter -A INPUT -p udp --dport 445 -j ACCEPT

iptables -t filter -A INPUT -p udp --dport 138 -j ACCEPT

--------------tcp

iptables -t filter -A INPUT -p tcp --dport 137 -j ACCEPT

iptables -t filter -A INPUT -p tcp --dport 139 -j ACCEPT

iptables -t filter -A INPUT -p tcp --dport 445 -j ACCEPT

iptables -t filter -A INPUT -p tcp --dport 138 -j ACCEPT

----- OUTPUT

--------------udp

iptables -t filter -A OUTPUT -p udp --sport 137 -j ACCEPT

iptables -t filter -A OUTPUT -p udp --sport 138 -j ACCEPT

iptables -t filter -A OUTPUT -p udp --sport 139 -j ACCEPT

iptables -t filter -A OUTPUT -p udp --sport 445 -j ACCEPT

--------------tcp

iptables -t filter -A OUTPUT -p tcp --sport 137 -j ACCEPT

iptables -t filter -A OUTPUT -p tcp --sport 138 -j ACCEPT

iptables -t filter -A OUTPUT -p tcp --sport 139 -j ACCEPT

iptables -t filter -A OUTPUT -p tcp --sport 445 -j ACCEPT

sadly though with no joy,my iptables -L looks like

root@Debian-VM:~# iptables -L
Chain INPUT (policy DROP)
target     prot opt source               destination
[...]
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:netbios-ns
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:netbios-dgm
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:netbios-ssn
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:microsoft-ds
ACCEPT     udp  --  anywhere             anywhere             udp dpt:netbios-ns
ACCEPT     udp  --  anywhere             anywhere             udp dpt:netbios-dgm
ACCEPT     udp  --  anywhere             anywhere             udp dpt:netbios-ssn
ACCEPT     udp  --  anywhere             anywhere             udp dpt:microsoft-ds
[...]
Chain FORWARD (policy DROP)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
[...]
ACCEPT     tcp  --  anywhere             anywhere             tcp spt:netbios-ns
ACCEPT     tcp  --  anywhere             anywhere             tcp spt:netbios-dgm
ACCEPT     tcp  --  anywhere             anywhere             tcp spt:netbios-ssn
ACCEPT     tcp  --  anywhere             anywhere             tcp spt:microsoft-ds
ACCEPT     udp  --  anywhere             anywhere             udp spt:microsoft-ds
ACCEPT     udp  --  anywhere             anywhere             udp spt:netbios-ssn
ACCEPT     udp  --  anywhere             anywhere             udp spt:netbios-dgm
ACCEPT     udp  --  anywhere             anywhere             udp spt:netbios-ns
[...]

what am i missing ?

thank you in advance for your answers

Nicolas

3
  • You are missing RPC.
    – Rui F Ribeiro
    Oct 25, 2018 at 13:37
  • thanks for your comment i tried to open 111 135 tcp and udp ports for rpc sadly it didn't work
    – nicolas
    Oct 25, 2018 at 14:38
  • 111 is just for negotiation, you need an upper range that I have not present in memory.
    – Rui F Ribeiro
    Oct 25, 2018 at 15:42

1 Answer 1

Reset to default
0

since i've only installed cifs-utils i didn't need 138 139 137 here's what worked for me:

iptables -t filter -A OUTPUT -p tcp --dport 445 -j ACCEPT
iptables -t filter -A INPUT -p tcp --sport 445 -j ACCEPT

i hope it will be helpful to somebody else :-)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .