No momento, estou tentando abrir o firewall iptables para o Samba, mas as configurações que encontrei no portal diferente não estão funcionando. Sem firewall tudo está funcionando corretamente. Com o firewall ativado, não consigo ver nenhum erro nos logs, exceto no nmbd.log.
[2017/07/24 15:07:47.107717, 0] ../source3/libsmb/nmblib.c:873(send_udp)
Packet send failed to 192.168.0.46(137) ERRNO=Operation not permitted
[2017/07/24 15:07:47.107808, 0] ../source3/nmbd/nmbd_packets.c:1026(reply_netbios_packet)
reply_netbios_packet: send_packet to IP 192.168.0.46 port 137 failed
[2017/07/24 15:10:30.841301, 0] ../source3/libsmb/nmblib.c:873(send_udp)
Packet send failed to 192.168.0.255(137) ERRNO=Operation not permitted
[2017/07/24 15:10:30.841395, 0] ../source3/nmbd/nmbd_packets.c:179(send_netbios_packet)
send_netbios_packet: send_packet() to IP 192.168.0.255 port 137 failed
[2017/07/24 15:10:30.841421, 0] ../source3/nmbd/nmbd_namequery.c:245(query_name)
query_name: Failed to send packet trying to query name WORKGROUP<1d>
[2017/07/24 15:12:34.203550, 0] ../source3/libsmb/nmblib.c:873(send_udp)
Packet send failed to 192.168.0.255(138) ERRNO=Operation not permitted
[2017/07/24 15:12:34.203669, 0] ../source3/libsmb/nmblib.c:873(send_udp)
Packet send failed to 192.168.0.255(138) ERRNO=Operation not permitted
Todas as portas que são necessárias para o samba estão escutando.
xyz@nuc:~# netstat -tulpn | egrep "samba|smbd|nmbd|winbind"
tcp 0 0 0.0.0.0:139 0.0.0.0:* LISTEN 517/smbd
tcp 0 0 0.0.0.0:445 0.0.0.0:* LISTEN 517/smbd
tcp6 0 0 :::139 :::* LISTEN 517/smbd
tcp6 0 0 :::445 :::* LISTEN 517/smbd
udp 0 0 192.168.0.255:137 0.0.0.0:* 576/nmbd
udp 0 0 192.168.0.2:137 0.0.0.0:* 576/nmbd
udp 0 0 192.168.0.255:137 0.0.0.0:* 576/nmbd
udp 0 0 192.168.0.249:137 0.0.0.0:* 576/nmbd
udp 0 0 0.0.0.0:137 0.0.0.0:* 576/nmbd
udp 0 0 192.168.0.255:138 0.0.0.0:* 576/nmbd
udp 0 0 192.168.0.2:138 0.0.0.0:* 576/nmbd
udp 0 0 192.168.0.255:138 0.0.0.0:* 576/nmbd
udp 0 0 192.168.0.249:138 0.0.0.0:* 576/nmbd
udp 0 0 0.0.0.0:138 0.0.0.0:* 576/nmbd
E a configuração do iptables agora:
iptables -F
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
#Allow traffic on loopback
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
#dhcp
iptables -I INPUT -i enp0s25 -p udp --dport 67:68 --sport 67:68 -j ACCEPT
#Incoming ssh connection (server)
iptables -A INPUT -i enp0s25 -p tcp --dport 2222 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o enp0s25 -p tcp --sport 2222 -m state --state ESTABLISHED -j ACCEPT
#Outgoing ssh connection (client)
iptables -A OUTPUT -o enp0s25 -p tcp --dport 2222 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i enp0s25 -p tcp --sport 2222 -m state --state ESTABLISHED -j ACCEPT
##PING INCOMING ICMP
iptables -A INPUT -p icmp --icmp-type 8 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -p icmp --icmp-type 0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -p icmp --icmp-type 8 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p icmp --icmp-type 0 -m state --state ESTABLISHED,RELATED -j ACCEPT
##SMTP##
#iptables -A OUTPUT -p tcp --sport 25 -m conntrack --ctstate ESTABLISHED -j ACCEPT
#iptables -A OUTPUT -p tcp --dport 25 -j ACCEPT
#iptables -A INPUT -p tcp --sport 25 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp --dport 25 -j ACCEPT
iptables -A INPUT -p tcp --dport 587 -j ACCEPT
iptables -A INPUT -p tcp --dport 465 -j ACCEPT
##SMB
iptables -A INPUT -i enp0s25 -p udp --dport 137:138 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o enp0s25 -p udp --sport 137:138 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -i enp0s25 -p tcp --dport 139 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o enp0s25 -p tcp --sport 139 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o enp0s25 -p udp --sport 445 -m state --state ESTABLISHED -j ACCEPT
#iptables -A OUTPUT -m state --state NEW,ESTABLISHED -p udp --dport 137 -j ACCEPT
#iptables -A OUTPUT -m state --state NEW,ESTABLISHED -p udp --dport 138 -j ACCEPT
#iptables -A OUTPUT -m state --state NEW,ESTABLISHED -p tcp --dport 139 -j ACCEPT
#iptables -A OUTPUT -m state --state NEW,ESTABLISHED -p tcp --dport 445 -j ACCEPT
#iptables -A INPUT -p udp -m udp --dport 137 -j ACCEPT
#iptables -A INPUT -p udp -m udp --dport 138 -j ACCEPT
#iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 139 -j ACCEPT
#iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 445 -j ACCEPT
#iptables -A INPUT -p tcp -m multiport --dport 139,445 -j ACCEPT
#iptables -A INPUT -p udp -m multiport --dport 137,138 -j ACCEPT
#iptables -A OUTPUT -p tcp -m multiport --dport 139,445 -j ACCEPT
#iptables -A OUTPUT -p udp -m multiport --dport 137,138 -j ACCEPT
#iptables -A INPUT -p udp -m udp --dport 137 -j ACCEPT
#iptables -A INPUT -p udp -m udp --dport 138 -j ACCEPT
#iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 139 -j ACCEPT
#iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 445 -j ACCEPT
#Allow apt-get requests (HTTP)
iptables -A OUTPUT -p tcp --dport 80 --sport 32768:61000 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp --sport 80 --dport 32768:61000 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p udp --dport 53 --sport 32768:61000 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -p udp --sport 53 --dport 32768:61000 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7
Alguém pode me dar uma dica, como eu posso configurar o iptables para SMTP e samba corretamente?
Atenciosamente
Kaffi