Date: Thu, 16 Nov 2006 20:11:21 +0200 From: Andrei Kolu <antik@bsd.ee> To: freebsd-pf@freebsd.org Subject: Re: problems connecting samba shares Message-ID: <200611162011.21765.antik@bsd.ee> In-Reply-To: <20061116100307.GC32666@nexus.subspacefield.org> References: <56217.24.161.8.173.1159492654.squirrel@mail.poklib.org> <200611151910.53727.antik@bsd.ee> <20061116100307.GC32666@nexus.subspacefield.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Thursday 16 November 2006 12:03, you wrote: > On Wed, Nov 15, 2006 at 07:10:51PM +0200, Andrei Kolu wrote: > > I am struggling here with PF firewall and just can't connect to any samba > > share if PF is enabled: > > That's because the SMB protocol was designed in total ignorance of > firewalls (and, to be fair, is much older than the first book on > firewalls). Like "talk" and other such protocols, which are virtually > impossible to do safely across a firewall, it has a mishmash of > connections in and out and back in again. > > You may find this page of mine useful; using the information here > might get you up and running, but you'll be poking some serious > holes in the firewall to do this. > > http://www.subspacefield.org/~travis/firewalls_and_protocols.html > > You may find this old paper interesting though: > http://web.textfiles.com/hacking/cifs.txt > > Ack, I gave in to curiousity, read a bit, and now I need a shower. > I couldn't get past the "Phase 0". Perhaps Bill Gates is a genius, > not because CIFS/SMB is great, but because it is so horrible; > yet he actually got people to pay for it. That counts for something. > > But given that MS Services for Unix is free, wouldn't you be > happier using NFS than some dodgy proprietary anachronism that > is so chock full of arbitrariness that it boggles and stupefies > the mind? Let's just pretend IPX and SMB never existed. In a > decade nobody will even remember it. Here's to hoping. Yes, I understand that SMB is bad, but why PF blocks port that is opened with rules? /etc/pf.conf: pass in on rl0 proto udp from any to (rl0) port 137 keep state # tcpdump -n -e -ttt -i pflog0: rule 0/0(match): block in on rl0: 192.168.2.100.137 > 192.168.2.101.53259: NBT UDP PACKET(137): QUERY; POSITIVE; RESPONSE; UNICAST
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200611162011.21765.antik>