block windows file sharing traffic between networks


Login or Register for Dates, Times and to Reply

 
Thread Tools Search this Thread
# 8  
Quote:
Originally Posted by herot
why do you want it to be wireless router instead of a computer?
Mostly, because it's easier to hook up a keyboard and monitor to a computer if you firewall yourself out. Though I'm sure I'm preaching to the choir there.

Also because it changes your environment quite a bit. I suppose you've got a full iptables, but nearly everything else is a feature-reduced version of what you'd get on a PC.
# 9  
didn't work

Code:
root@?:/tmp/home/root# iptables -A INPUT -s 192.0.0.0/24 -d 192.0.3.0/24 '!' -dp
orts 9100,22,23 -j DROP
iptables v1.3.8: multiple -d flags not allowed
Try `iptables -h' or 'iptables --help' for more information.
root@?:/tmp/home/root# iptables -A INPUT -s 192.0.3.0/24 -d 192.0.0.0/24 '!' -dp
orts 9100,22,23 -j DROP
iptables v1.3.8: multiple -d flags not allowed
Try `iptables -h' or 'iptables --help' for more information.
root@?:/tmp/home/root#

---------- Post updated at 11:09 PM ---------- Previous update was at 08:17 PM ----------

I tried this:
Code:
iptables -I OUTPUT 1 -p tcp -d 192.0.0.0/24 --dport 22 -j ACCEPT
iptables -I OUTPUT 2 -p tcp -d 192.0.0.0/24 --dport 23 -j ACCEPT
iptables -I OUTPUT 3 -p tcp -d 192.0.0.0/24 --dport 9100 -j ACCEPT
iptables -I OUTPUT 4 -d 192.0.0.0/24 -j DROP

It cut my access off entirely. Do I need to make the drop portion the first in the list?
# 10  
Quote:
Originally Posted by Corona688
That's odd. It usually doesn't make sense to route SMB traffic at all. Do the computers believe they're all on one big subnet? That'd be more like bridging.
Our network topo is this:

We have dual homed servers. 1 home is 192.0.10.0 (main home LAN) other home is 192.0.0.0 (WAN). We have the 192.0.0.0 (WAN) so our servers can talk over WAN to our other location (192.0.3.0). It is a Frame Relay connection. We have serial network printers in the other location (192.0.3.0) but the server (that people work on and send print jobs from) is at the main location (192.0.0.0).

NOW the other location. It's LAN is 192.0.3.0. It still needs to talk to 192.0.0.0 (WAN) to connect to the unix server (off site) and so the unix server can send print jobs to the (on site) printers. THUS, 192.0.3.0 (other home LAN) must communicate with 192.0.0.0 (WAN) but it only needs to for those printing purposes. I could let the clients ssh over internet for the terminal sessions.

in short:

main site ------------------------------------------other site
LAN1 (192.0.10.0) ------ WAN (192.0.0.0) -------- LAN2 (192.0.3.0)
server here -------------------------------------------printer here

The issue that caught my eye is this:

192.0.3.0 (LAN) router has static route to 192.0.0.0 frame (WAN)

I just installed a NAS on the 192.0.3.0 LAN. I mapped a share from the NAS to a network drive on a pc. I started a image backup from some backup software we use (EaseUS Todo) to image the pc drive to the NAS share. Job running fine. Frame starts dropping print jobs. Frame drops hella pings. I log back in to the pc that is being backed up and KILL the backup. INSTA presto Frame (WAN) (192.0.0.0) comes back up and starts working fine again.

my conclusion:

I need to stop all traffic except essential from possibly leaking onto WAN frame (192.0.0.0) from 192.0.3.0 OR 192.0.10.0


AND by the way,

should this let me block all traffic except when from ports 9100,22,23?:

(following ip tables to be put in the 192.0.3.0 LAN router)

Code:
iptables -I OUTPUT 1 -p tcp -d 192.0.0.0/24 --dport 22 -j ACCEPT
iptables -I OUTPUT 2 -p tcp -d 192.0.0.0/24 --dport 23 -j ACCEPT
iptables -I OUTPUT 3 -p tcp -d 192.0.0.0/24 --dport 9100 -j ACCEPT
iptables -I OUTPUT 4 -d 192.0.0.0/24 -j DROP


Last edited by herot; 12-05-2011 at 10:26 AM..
# 11  
What those rules do greatly depends on your existing firewall setup. That's another reason it's good to know that you're using a wireless router: It means you probably already have a fairly complicated pre-packaged firewall setup that neither of us know much about. It might be better to use their system than craft raw rules yourself if posssible.

What's this -I OUTPUT 4? Why not just append rules at the same time as the firewall's being made instead of inserting later?
# 12  
Quote:
Originally Posted by Corona688
What those rules do greatly depends on your existing firewall setup. That's another reason it's good to know that you're using a wireless router: It means you probably already have a fairly complicated pre-packaged firewall setup that neither of us know much about. It might be better to use their system than craft raw rules yourself if posssible.

What's this -I OUTPUT 4? Why not just append rules at the same time as the firewall's being made instead of inserting later?
Well it goes DSL modem---Wireless router/LAN (static route from 192.0.3.0 to 192.0.0.0)

There is NAT at the modem and the router has some ports forwarded. There is no other hardware/software firewall.

Wireless router tells 192.0.3.0 how to get to 192.0.0.0. All I want to do is put some restrictions on the traffic that goes over that static route.

Dont I need to use -I OUTPUT for traffic leaving the router? Maybe I'm confused ... The WAN port on router is connected to dsl modem. The LAN ports on the router go to the switch to the 192.0.0.0 gateway device...
# 13  
-I inserts rules at the beginning. Why not -A? The difference could be important, especially with my present near-total ignorance of your current firewall. Depending on your firewall rules it's entirely possible that neither will work, and the rules have to be put in the appropriate place in your firewall instead of appended or prepended...

And for traffic to leave the router, it must also enter the router, yes? I think INPUT is more appropriate.

Have you tried the syntax as I actually gave them to you? I guess you can't use -dports, but otherwise...

Knowing your current firewall setup would be useful too...
# 14  
Quote:
Originally Posted by Corona688
-I inserts rules at the beginning. Why not -A? The difference could be important, especially with my present near-total ignorance of your current firewall. Depending on your firewall rules it's entirely possible that neither will work, and the rules have to be put in the appropriate place in your firewall instead of appended or prepended...

And for traffic to leave the router, it must also enter the router, yes? I think INPUT is more appropriate.

Have you tried the syntax as I actually gave them to you? I guess you can't use -dports, but otherwise...

Knowing your current firewall setup would be useful too...
OK I will use -A INPUT

What is this firewall you speak of? The only things on the ends of the WAN frame are the multiplexors ... they shoot straight into to the switch.

192.0.3.0 & 192.0.0.0 think they are on the same network or subnet.

I tried syntax as you gave it. It didn't like the '!' Thats why I wanted to do something similar to the commands I gave you earlier.
Login or Register for Dates, Times and to Reply

Previous Thread | Next Thread
Thread Tools Search this Thread
Search this Thread:
Advanced Search

8 More Discussions You Might Find Interesting

1. Solaris

Sharing to Windows

hiiii, recently we installed samba in solaris 11 machine. and create filesystem and mounted it. we want to mount the same file system in another windows machine through samba. How share that file system to windows and how to mount in windows . (2 Replies)
Discussion started by: Brahmam CH
2 Replies

2. UNIX for Advanced & Expert Users

Enterprise level Solaris&Windows file sharing

"Samba," I know, I know. However, I am a gov't worker and Samba is off the table. Does anyone have a recommendation for an off the shelf, secure solution? I've already suggested rsync and NFS services for Windows Server and got shot down. (4 Replies)
Discussion started by: LittleLebowski
4 Replies

3. Solaris

SMB + Windows sharing

Hi guys I need to create one directory on my Solaris 11 box and then share that directory on my LAN. I have only one disk of 500 GB which is more than enough for my needs. I read SMB guide for Solaris and there is no guide how to achive share only on one directory, it has only tutorials for... (3 Replies)
Discussion started by: solaris_user
3 Replies

4. Solaris

Problem in File/Dir sharing between a windows and solaris

Hi , We are trying to share a particular directory between solaris running from VMware installed on Win7 box] and windows box. We tried the SWAT utility of samba, and made all possible changes for sharing. We committed the changes and we were clueless what need to be done further.. referred... (0 Replies)
Discussion started by: BalajiUthira
0 Replies

5. HP-UX

mount windows file sharing on hp-ux

Hi all, Can anyone teach me how to mount windows file sharing on hp-ux thanks (2 Replies)
Discussion started by: pantas manik
2 Replies

6. Solaris

Sharing Windows Folder on Solaris

Hi All, I am wanting so share a windows folder on our Solaris computer. I am wanting to be able to save files to this folder directly on Windows. This will keep me from saving a file locally and FTPing to the windows HD. Currently, I am trying to get "services for Unix Administration" to... (1 Reply)
Discussion started by: patm95
1 Replies

7. Linux

Please help me, about the file sharing with windows system

Did anybody can teach me how to set the premission in the samba server? How to i set the premission in one folder but two access right. With one folder but the user access rights is diffirent. One user can full access the folder, and another one user only read only. thx for helping... (1 Reply)
Discussion started by: cloudlor
1 Replies

8. Windows & DOS: Issues & Discussions

Windows Server 2003 file sharing with UNIX

We have a Windows Server 2003 box and I'd like to share a drive with a Sun Solaris box so that the Sun Solaris box can copy files to/from the Windows Server 2003. I believe that Windows Services for UNIX 3.5 will allow me to do this, can anyone comfirm this ? Also, any links on how to... (1 Reply)
Discussion started by: markgrimes
1 Replies

Featured Tech Videos