Arch Linux

mrlamud

Member

Registered: 2014-09-27

Posts: 105

[SOLVED] iptables - prevent the Guest OS to re-connect samba share.

The first call is fine but once shutdown virtual machine and restart it again then I can not re-connect the shared folder.
I would like to know which iptables rules might prevent the re-connection.

smb.conf

[global]
	bind interfaces only = Yes
	interfaces = lo eno1
	server string = XXX_Samba_Server
	log file = /var/log/samba/%m.log
	max log size = 50
	max xmit = 65536
	min receivefile size = 16384
	client lanman auth = Yes
	client NTLMv2 auth = No
	map to guest = Bad User
	security = USER
	socket options = TCP_NODELAY IPTOS_LOWDELAY
	dns proxy = No
	idmap config * : backend = tdb
	use sendfile = Yes
	write cache size = 262144


[private]
	comment = Private Share
	path = /mnt/ZORO
	read only = No
	valid users = XXXX

iptables:

# Generated by iptables-save v1.6.0 on Fri Aug 12 16:41:09 2016
*mangle
:PREROUTING ACCEPT [380:18486]
:INPUT ACCEPT [380:18486]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [380:25418]
:POSTROUTING ACCEPT [380:25418]
COMMIT
# Completed on Fri Aug 12 16:41:09 2016
# Generated by iptables-save v1.6.0 on Fri Aug 12 16:41:09 2016
*nat
:PREROUTING ACCEPT [54:2688]
:INPUT ACCEPT [54:2688]
:OUTPUT ACCEPT [42:2520]
:POSTROUTING ACCEPT [42:2520]
COMMIT
# Completed on Fri Aug 12 16:41:09 2016
# Generated by iptables-save v1.6.0 on Fri Aug 12 16:41:09 2016
*raw
:PREROUTING ACCEPT [380:18486]
:OUTPUT ACCEPT [380:25418]
-A PREROUTING -m rpfilter --invert -j DROP
-A OUTPUT -p udp -m udp --dport 137 -j CT --helper netbios-ns
COMMIT
# Completed on Fri Aug 12 16:41:09 2016
# Generated by iptables-save v1.6.0 on Fri Aug 12 16:41:09 2016
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [380:25418]
:IN_SSH - [0:0]
:TCP - [0:0]
:UDP - [0:0]
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m conntrack --ctstate INVALID -j DROP
-A INPUT -p icmp -m icmp --icmp-type 8 -m conntrack --ctstate NEW -j ACCEPT
-A INPUT -p udp -m conntrack --ctstate NEW -j UDP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m conntrack --ctstate NEW -j TCP
-A INPUT -p tcp -m recent --set --name TCP-PORTSCAN --mask 255.255.255.255 --rsource -j REJECT --reject-with tcp-reset
-A INPUT -p udp -m recent --set --name UDP-PORTSCAN --mask 255.255.255.255 --rsource -j REJECT --reject-with icmp-port-unreachable
-A INPUT -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -j IN_SSH
-A INPUT -j REJECT --reject-with icmp-proto-unreachable
-A IN_SSH -m recent --rcheck --seconds 10 --hitcount 3 --rttl --name sshbf --mask 255.255.255.255 --rsource -j DROP
-A IN_SSH -m recent --rcheck --seconds 1800 --hitcount 4 --rttl --name sshbf --mask 255.255.255.255 --rsource -j DROP
-A IN_SSH -m recent --set --name sshbf --mask 255.255.255.255 --rsource -j ACCEPT
-A TCP -p tcp -m recent --update --seconds 60 --name TCP-PORTSCAN --mask 255.255.255.255 --rsource -j REJECT --reject-with tcp-reset
-A TCP -p tcp -m multiport --dports 53,80,443,25,110,143,62062,8991,6881,9777,39901,139,445,5939 -j ACCEPT
-A TCP -p tcp -m multiport --dports 9000:9001,56881:56889 -j ACCEPT
-A UDP -p udp -m recent --update --seconds 60 --name UDP-PORTSCAN --mask 255.255.255.255 --rsource -j REJECT --reject-with icmp-port-unreachable
-A UDP -p udp -m multiport --dports 53,8991,6881,9777,137,138 -j ACCEPT
-A UDP -p udp -m multiport --dports 67:68,56881:56889 -j ACCEPT
COMMIT
# Completed on Fri Aug 12 16:41:09 2016

Solved by removing  "-A PREROUTING -m rpfilter --invert -j DROP" in *raw*
There are  lots to learn for me.

Last edited by mrlamud (2016-08-15 03:05:03)