You are not logged in.

Pages: 1

Topic closed

#1 2016-11-08 01:45:42

ErSoul
Member
Registered: 2012-01-26
Posts: 54

UFW blocking Dolphin SAMBA Browser, and smbtree.

I have a debian 8 server running samba. When I try to browse with my archlinux system (with ufw installed), it returns nothing neither smbtree, nor Dolphin, when UFW is active.

The weird thing is that smbclient -L $MYHOST it does return my shares.

I checked that the nf_conntrack_netbios_ns its included on the IPT_MODULES array.

Though I  believe its not necessary, I opened all the SAMBA ports from my arch system.

Offline

#2 2016-11-08 04:41:40

HiImTye
Member
From: Halifax, NS, Canada
Registered: 2012-05-09
Posts: 1,072

Re: UFW blocking Dolphin SAMBA Browser, and smbtree.

what's the output of

# ufw status verbose

Offline

#3 2016-11-08 04:47:01

ErSoul
Member
Registered: 2012-01-26
Posts: 54

Re: UFW blocking Dolphin SAMBA Browser, and smbtree.

Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), deny (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
3020                       ALLOW IN    Anywhere                  
137                        ALLOW IN    Anywhere                  
138                        ALLOW IN    Anywhere                  
139                        ALLOW IN    Anywhere                  
445                        ALLOW IN    Anywhere                  
53                         ALLOW IN    Anywhere                  
1024:5000/udp              ALLOW IN    Anywhere                  
3020 (v6)                  ALLOW IN    Anywhere (v6)             
137 (v6)                   ALLOW IN    Anywhere (v6)             
138 (v6)                   ALLOW IN    Anywhere (v6)             
139 (v6)                   ALLOW IN    Anywhere (v6)             
445 (v6)                   ALLOW IN    Anywhere (v6)             
53 (v6)                    ALLOW IN    Anywhere (v6)             
1024:5000/udp (v6)         ALLOW IN    Anywhere (v6)

The last rule I added, cause I read that nmbd uses those rpc ports

Offline

#4 2016-11-08 05:27:28

HiImTye
Member
From: Halifax, NS, Canada
Registered: 2012-05-09
Posts: 1,072

Re: UFW blocking Dolphin SAMBA Browser, and smbtree.

137-139, 445 is all that you should need for samba, what I'm curious about is what happens when you set routed to allow

Offline

#5 2016-11-08 05:50:03

ErSoul
Member
Registered: 2012-01-26
Posts: 54

Re: UFW blocking Dolphin SAMBA Browser, and smbtree.

Nothing happens. Same results.

Offline

#6 2016-11-08 06:30:50

HiImTye
Member
From: Halifax, NS, Canada
Registered: 2012-05-09
Posts: 1,072

Re: UFW blocking Dolphin SAMBA Browser, and smbtree.

alright, what about the output of

# iptables-save

Offline

#7 2016-11-08 13:03:11

ErSoul
Member
Registered: 2012-01-26
Posts: 54

Re: UFW blocking Dolphin SAMBA Browser, and smbtree.

# Generated by iptables-save v1.6.0 on Tue Nov  8 08:58:41 2016
*filter
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:ufw-after-forward - [0:0]
:ufw-after-input - [0:0]
:ufw-after-logging-forward - [0:0]
:ufw-after-logging-input - [0:0]
:ufw-after-logging-output - [0:0]
:ufw-after-output - [0:0]
:ufw-before-forward - [0:0]
:ufw-before-input - [0:0]
:ufw-before-logging-forward - [0:0]
:ufw-before-logging-input - [0:0]
:ufw-before-logging-output - [0:0]
:ufw-before-output - [0:0]
:ufw-logging-allow - [0:0]
:ufw-logging-deny - [0:0]
:ufw-not-local - [0:0]
:ufw-reject-forward - [0:0]
:ufw-reject-input - [0:0]
:ufw-reject-output - [0:0]
:ufw-skip-to-policy-forward - [0:0]
:ufw-skip-to-policy-input - [0:0]
:ufw-skip-to-policy-output - [0:0]
:ufw-track-forward - [0:0]
:ufw-track-input - [0:0]
:ufw-track-output - [0:0]
:ufw-user-forward - [0:0]
:ufw-user-input - [0:0]
:ufw-user-limit - [0:0]
:ufw-user-limit-accept - [0:0]
:ufw-user-logging-forward - [0:0]
:ufw-user-logging-input - [0:0]
:ufw-user-logging-output - [0:0]
:ufw-user-output - [0:0]
-A INPUT -j ufw-before-logging-input
-A INPUT -j ufw-before-input
-A INPUT -j ufw-after-input
-A INPUT -j ufw-after-logging-input
-A INPUT -j ufw-reject-input
-A INPUT -j ufw-track-input
-A FORWARD -j ufw-before-logging-forward
-A FORWARD -j ufw-before-forward
-A FORWARD -j ufw-after-forward
-A FORWARD -j ufw-after-logging-forward
-A FORWARD -j ufw-reject-forward
-A FORWARD -j ufw-track-forward
-A OUTPUT -j ufw-before-logging-output
-A OUTPUT -j ufw-before-output
-A OUTPUT -j ufw-after-output
-A OUTPUT -j ufw-after-logging-output
-A OUTPUT -j ufw-reject-output
-A OUTPUT -j ufw-track-output
-A ufw-after-input -p udp -m udp --dport 137 -j ufw-skip-to-policy-input
-A ufw-after-input -p udp -m udp --dport 138 -j ufw-skip-to-policy-input
-A ufw-after-input -p tcp -m tcp --dport 139 -j ufw-skip-to-policy-input
-A ufw-after-input -p tcp -m tcp --dport 445 -j ufw-skip-to-policy-input
-A ufw-after-input -p udp -m udp --dport 67 -j ufw-skip-to-policy-input
-A ufw-after-input -p udp -m udp --dport 68 -j ufw-skip-to-policy-input
-A ufw-after-input -m addrtype --dst-type BROADCAST -j ufw-skip-to-policy-input
-A ufw-after-logging-input -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
-A ufw-before-forward -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A ufw-before-forward -p icmp -m icmp --icmp-type 3 -j ACCEPT
-A ufw-before-forward -p icmp -m icmp --icmp-type 4 -j ACCEPT
-A ufw-before-forward -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A ufw-before-forward -p icmp -m icmp --icmp-type 12 -j ACCEPT
-A ufw-before-forward -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A ufw-before-forward -j ufw-user-forward
-A ufw-before-input -i lo -j ACCEPT
-A ufw-before-input -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A ufw-before-input -m conntrack --ctstate INVALID -j ufw-logging-deny
-A ufw-before-input -m conntrack --ctstate INVALID -j DROP
-A ufw-before-input -p icmp -m icmp --icmp-type 3 -j ACCEPT
-A ufw-before-input -p icmp -m icmp --icmp-type 4 -j ACCEPT
-A ufw-before-input -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A ufw-before-input -p icmp -m icmp --icmp-type 12 -j ACCEPT
-A ufw-before-input -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A ufw-before-input -p udp -m udp --sport 67 --dport 68 -j ACCEPT
-A ufw-before-input -j ufw-not-local
-A ufw-before-input -d 224.0.0.251/32 -p udp -m udp --dport 5353 -j ACCEPT
-A ufw-before-input -d 239.255.255.250/32 -p udp -m udp --dport 1900 -j ACCEPT
-A ufw-before-input -j ufw-user-input
-A ufw-before-output -o lo -j ACCEPT
-A ufw-before-output -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A ufw-before-output -j ufw-user-output
-A ufw-logging-allow -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW ALLOW] "
-A ufw-logging-deny -m conntrack --ctstate INVALID -m limit --limit 3/min --limit-burst 10 -j RETURN
-A ufw-logging-deny -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
-A ufw-not-local -m addrtype --dst-type LOCAL -j RETURN
-A ufw-not-local -m addrtype --dst-type MULTICAST -j RETURN
-A ufw-not-local -m addrtype --dst-type BROADCAST -j RETURN
-A ufw-not-local -m limit --limit 3/min --limit-burst 10 -j ufw-logging-deny
-A ufw-not-local -j DROP
-A ufw-skip-to-policy-forward -j ACCEPT
-A ufw-skip-to-policy-input -j DROP
-A ufw-skip-to-policy-output -j ACCEPT
-A ufw-track-forward -p tcp -m conntrack --ctstate NEW -j ACCEPT
-A ufw-track-forward -p udp -m conntrack --ctstate NEW -j ACCEPT
-A ufw-track-output -p tcp -m conntrack --ctstate NEW -j ACCEPT
-A ufw-track-output -p udp -m conntrack --ctstate NEW -j ACCEPT
-A ufw-user-input -p tcp -m tcp --dport 3020 -j ACCEPT
-A ufw-user-input -p udp -m udp --dport 3020 -j ACCEPT
-A ufw-user-input -p tcp -m tcp --dport 137 -j ACCEPT
-A ufw-user-input -p udp -m udp --dport 137 -j ACCEPT
-A ufw-user-input -p tcp -m tcp --dport 138 -j ACCEPT
-A ufw-user-input -p udp -m udp --dport 138 -j ACCEPT
-A ufw-user-input -p tcp -m tcp --dport 139 -j ACCEPT
-A ufw-user-input -p udp -m udp --dport 139 -j ACCEPT
-A ufw-user-input -p tcp -m tcp --dport 445 -j ACCEPT
-A ufw-user-input -p udp -m udp --dport 445 -j ACCEPT
-A ufw-user-input -p tcp -m tcp --dport 53 -j ACCEPT
-A ufw-user-input -p udp -m udp --dport 53 -j ACCEPT
-A ufw-user-input -p udp -m multiport --dports 1024:5000 -j ACCEPT
-A ufw-user-limit -m limit --limit 3/min -j LOG --log-prefix "[UFW LIMIT BLOCK] "
-A ufw-user-limit -j REJECT --reject-with icmp-port-unreachable
-A ufw-user-limit-accept -j ACCEPT
COMMIT
# Completed on Tue Nov  8 08:58:41 2016

Offline

#8 2018-04-16 00:35:29

doskoi
Member
Registered: 2016-04-10
Posts: 24

Re: UFW blocking Dolphin SAMBA Browser, and smbtree.

It's probably because /proc/sys/net/netfilter/nf_conntrack_helper is set to 0 since linux kernel version 4.7.
You can re-enable it, but I don't know the security implications :p

$ cat /etc/sysctl.d/99-ufw.conf
net.netfilter.nf_conntrack_helper = 1

Last edited by doskoi (2018-04-16 00:35:45)

Offline

#9 2018-04-16 00:39:19

circleface
Member
Registered: 2012-05-26
Posts: 639

Re: UFW blocking Dolphin SAMBA Browser, and smbtree.

Thank you for your solution, however please pay attention to the date this was posted and do not necrobump old threads.

Offline

#10 2018-04-16 00:53:32

fukawi2
Ex-Administratorino
From: .vic.au
Registered: 2007-09-28
Posts: 6,238
Website

Re: UFW blocking Dolphin SAMBA Browser, and smbtree.

doskoi, thank you for contributing information that may help others who find this thread. Given the age of the thread, further relevant discussion is unlikely. If anyone wants to continue the discussion, please start a new thread that references this one, or use the report button to request that this one be re-opened.
If you are reading this in search for a solution be aware that this information might not apply any longer and more recent threads discussing similar problems may exist.

Closing.

Are you familiar with our Forum Rules, and How To Ask Questions The Smart Way?

BlueHackers // fscanary // resticctl

Offline

Pages: 1

Topic closed

Board footer

Powered by FluxBB