iptables block samba [resolved]

[DaggyStyle]

the headers says it all, I think I've got the rules right, something is still blocking samba
here is iptable rules:

[Berty]

As far as I remember, you need module ip_conntrack to be loaded in order to trace machine states ( though I'm not sure ). Try to check if it's loaded.

[DaggyStyle]

yes, compile has module

here is the relevant .config

[DaggyStyle]

apparently this:

[coolsnowmen]

are you removing that line, (the one that says 'else reject')
doesn't that defeat the purpose of having a firewall?
_________________
emerge: there are no ebuilds to satisfy "moo"

[schachti]

[DaggyStyle]

ok, then it is reopened, can you guys help me sort it out?
_________________
Only two things are infinite, the universe and human stupidity and I'm not sure about the former - Albert Einstein

[Hu]

Please use net-analyzer/tcpdump to capture some traffic sent from the Windows system. Run it as tcpdump -i any -v -n. Post the output.

Also, did you intend to offer Samba service to the Internet? You have rules for BitTorrent, which is typically an Internet facing service, so I assume this box is directly on the Internet.

[DaggyStyle]

the box is connected to a local network which is connected to the net, I want to use it has a share to the local network

here is less than a second output:

[DaggyStyle]

ok, alittle update after thinking of the samba openness, I've decided to limit samba to 2 networks, here are the new iptables rules:

[Hu]

That is an amazingly noisy network. Are other users actively using the network when you run this capture?

I see a large volume of UDP messages sent from :137 to a high port. These packets are rejected with an ICMP port unreachable. It is difficult to say whether this is because no process is listening or because the packet matched your REJECT target. The sheer volume of packets to examine makes deep inspection impractical.

[DaggyStyle]

it's a very busy network, I've seted the 137 udp has opened, how can it be rejecting it? is it related to the samba port selection in smb.conf?
_________________
Only two things are infinite, the universe and human stupidity and I'm not sure about the former - Albert Einstein

[DaggyStyle]

reviewing the log again shows that these ports 54355, 33793, 32857 are mostly used, but the following is strange

===============================================================================================================
# 09:45:01.544670 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 90) 132.72.148.243.137 > 132.72.148.243.32857: NBT UDP PACKET(137): QUERY; POSITIVE; RESPONSE; UNICAST
# 09:45:01.544692 IP (tos 0xc0, ttl 64, id 32832, offset 0, flags [none], proto ICMP (1), length 118) 132.72.148.243 > 132.72.148.243: ICMP 132.72.148.243 udp port 32857 unreachable, length 98
===============================================================================================================

is this the problematic port?
_________________
Only two things are infinite, the universe and human stupidity and I'm not sure about the former - Albert Einstein

[Hu]

[DaggyStyle]

unfortunately, this can take alot of time cause I wont be getting home soon
if I'll set a two computers network, will it work?
does it matte if it will be win to Linux or linux to linux?
_________________
Only two things are infinite, the universe and human stupidity and I'm not sure about the former - Albert Einstein

[Hu]

The host systems involved should not matter, unless it affects the exchange in such a way that your firewall rules permit one interaction and deny the other. I doubt such a situation will occur.

[DaggyStyle]

I've been able to setup the logging feature, here is the output:

[DaggyStyle]

solved! thanks to the iptables mailing list, I've added this:

[schachti]

Did they give any reason for this? The policy of the output chain was already set to ACCEPT, so why should one explicitly allow those packets?
_________________
Never argue with an idiot. He brings you down to his level, then beats you with experience.

How-To: Daten verschlüsselt auf DVD speichern.

[DaggyStyle]

they where intrigued too, apparently, I think that the connections that weren't new were ignored somehow
_________________
Only two things are infinite, the universe and human stupidity and I'm not sure about the former - Albert Einstein