From owner-freebsd-ipfw Thu Mar 8 1:48:28 2001 Delivered-To: freebsd-ipfw@freebsd.org Received: from mip.co.za (puck.mip.co.za [209.212.106.44]) by hub.freebsd.org (Postfix) with ESMTP id 53AF137B718; Thu, 8 Mar 2001 01:48:11 -0800 (PST) (envelope-from patrick@mip.co.za) Received: from patrick (patrick.mip.co.za [10.3.13.181]) by mip.co.za (8.9.3/8.9.3) with SMTP id LAA84667; Thu, 8 Mar 2001 11:47:45 +0200 (SAST) (envelope-from patrick@mip.co.za) From: "Patrick O'Reilly" To: "FreeBSD Network List" , "FreeBSD IPFW List" Subject: FW: MS Shares through IPFW Date: Thu, 8 Mar 2001 11:47:45 +0200 Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2314.1300 Sender: owner-freebsd-ipfw@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG Hi all! I need to allow some M$ clients to access M$ shares on an NT server, the clients and server being on opposite sides of a FreeBSD ipfw firewall. The firewall is running fine (has been for 6 months) but I cannot get this D**N Netbios stuff going. In my desperation I have gone as far as adding these two very loose rules, which are the very first rules in the ipfw chain: -------- /sbin/ipfw -q add 00009 allow log ip from 10.5.5.0/24 to 10.3.3.240 /sbin/ipfw -q add 00009 allow log ip from 10.3.3.240 to 10.5.5.0/24 -------- The 10.5.5.0/24 Subnet includes the client we are testing, and 10.3.3.240 is the NT Server. The 10.5.5.0/24 Subnet is remote across a VPN, but there are IP tunnels in place so that the extra hops are transparent -> I don't THINK they should be causing our problems. When the Client tries to map the share on the Server there is a whole bunch of traffic logged against rule #9, including ports UDP 137 and TCP 139, going back and forth between the client and server. The client is prompted for a login/password, which we enter VERY CAREFULLY to make sure we got it right, but thereafter the connection is refused. Is this something about M$ security, or is there something else I am not seeing that the firewall might be denying? The only curious thing I have observed is the following lines in the ipfw.log interspersed among all the "Accept" logs between these computers: -------- Mar 7 11:16:08 eccles /kernel: ipfw: 65534 Deny UDP 0.0.0.0:68 10.3.3.240:67 in via rl2 Mar 7 11:16:08 eccles /kernel: ipfw: 9 Accept UDP 10.5.5.1:67 10.3.3.240:67 in via rl2 Mar 7 11:16:08 eccles /kernel: ipfw: 9 Accept UDP 10.5.5.1:67 10.3.3.240:67 out via rl0 -------- I believe ports 67 and 68 are used for DHCP - we are not using DHCP anywhere, so I don't understand why this pops up, but I include it as it may be relevant ?!? Also, why is the source IP on the first line 0.0.0.0 ? Anyone with some more M$ / Netbios expertise - PLEASE HELP. Thanks, Patrick. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-ipfw" in the body of the message