Samba/SMB
Tom
Eastep
2002-10-22
2002
Thomas M. Eastep
Permission is granted to copy, distribute and/or modify this
document under the terms of the GNU Free Documentation License, Version
1.2 or any later version published by the Free Software Foundation; with
no Invariant Sections, with no Front-Cover, and with no Back-Cover
Texts. A copy of the license is included in the section entitled
GNU Free Documentation License
.
If you wish to run Samba on your firewall and access shares between
the firewall and local hosts, you need the following rules:
/etc/shorewall/rules:ACTIONSOURCEDESTINATIONPROTOCOLPORT(S)SOURCE
PORT(S)ORIGINAL DEST
ACCEPTfwlocudp137:139
ACCEPTfwloctcp137,139,445
ACCEPTfwlocudp1024:137
ACCEPTlocfwudp137:139
ACCEPTlocfwtcp137,139,445
ACCEPTlocfwudp1024:137
To pass traffic SMB/Samba traffic between zones Z1 and Z2:
/etc/shorewall/rules:ACTIONSOURCEDESTINATIONPROTOCOLPORT(S)SOURCE
PORT(S)ORIGINAL DEST
ACCEPTZ1Z2udp137:139
ACCEPTZ1Z2tcp137,139,445
ACCEPTZ1Z2udp1024:137
ACCEPTZ2Z1udp137:139
ACCEPTZ2Z1tcp137,139,445
ACCEPTZ2Z1udp1024:137
To make network browsing (Network Neighborhood
) work
properly between Z1 and Z2 requires a Windows Domain Controller and/or a
WINS server. I run Samba on my firewall to handle browsing between two zones
connected to my firewall. Details are here.