block windows file sharing traffic between networks


 
Thread Tools Search this Thread
Special Forums IP Networking block windows file sharing traffic between networks
# 1  
Old 12-02-2011
block windows file sharing traffic between networks

I have a LAN for users 192.0.3.0

I have a WAN for servers 192.0.0.0

I have a iptables capable router with a static route from 192.0.3.0 to 192.0.0.0

my problem is SMB file sharing traffic is leaking on to our 192.0.0.0 and causing congestion. I only have one printer IP address that needs to talk over 192.0.0.0

Can I use iptables to block traffic from all ip address from sending traffic over 192.0.0.0 except that one printer?

in short i need 192.0.3.102 to be the ONLY device that can talk to 192.0.0.10. NOTE: the iptables enabled router is on the 192.0.3.0 network.

Last edited by herot; 12-02-2011 at 12:28 PM..
# 2  
Old 12-02-2011
That's odd. It usually doesn't make sense to route SMB traffic at all. Do the computers believe they're all on one big subnet? That'd be more like bridging.

Anyway. I can't guarantee this is correct, being I rarely use iptables directly, but I think I have the right idea: Explicitly allow traffic to/from your printer's IP, then explicitly deny everything else. The first rule will match your printer traffic, the rest won't and will go to the next rule which will drop it.

Code:
# Assuming your printer's IP is 192.0.3.1
# Accept 0.0 -> printer traffic
iptables -A forward --source 192.0.0.0/24 --destination 192.0.3.1 -j ACCEPT
# Accept printer -> 0.0 traffic
iptables -A forward --source 192.0.3.1 --destination 192.0.0.0/255.255.255.0 -j ACCEPT
# Reject everything 0.0 -> 3.0
iptables -A forward --source 192.0.0.0/24 --destination 192.0.3.0/255.255.255.0 -j DROP
# Reject everything 3.0 -> 0.0
iptables -A forward --source 192.0.3.0/24 --destination 192.0.0.0/24 -j DROP

# 3  
Old 12-02-2011
Thanks!

Last edited by herot; 12-02-2011 at 12:59 PM..
# 4  
Old 12-02-2011
That might actually be a lot simpler than what I was thinking. I didn't know what ports your printer needed, of course.

Code:
iptables -A INPUT --source 192.0.0.0/24 --destination 192.0.3.0/24 '!' --dports 9100,22,23 -j DROP

I see you edited your question out from under me but dropping everything except specific ports may work too. Smilie
# 5  
Old 12-02-2011
The idea is sound I think but I am having trouble with the execution now.

i get

Code:
root@?:/tmp/home/root# iptables -A INPUT -s 192.0.0.0/24 -d 192.0.3.0/24 '!' --dports 9100,22,23 -j DROP                                                        
iptables v1.3.8: Unknown arg `--dports'                                         
Try `iptables -h' or 'iptables --help' for more information.                    
root@?:/tmp/home/root#

I am using tomato firmware in my router... I searched for similar issues but I haven't been able to find a solution to this syntax problem yet...
# 6  
Old 12-02-2011
It's -dports, not --dports, my apologies.

Also good to know this is a wireless router and not an actual computer.
# 7  
Old 12-02-2011
why do you want it to be wireless router instead of a computer?

ps

WRT54GL is my most favorite router of all time!

Ill let you know if I accomplish my goal.
Login or Register to Ask a Question

Previous Thread | Next Thread

8 More Discussions You Might Find Interesting

1. Solaris

Sharing to Windows

hiiii, recently we installed samba in solaris 11 machine. and create filesystem and mounted it. we want to mount the same file system in another windows machine through samba. How share that file system to windows and how to mount in windows . (2 Replies)
Discussion started by: Brahmam CH
2 Replies

2. UNIX for Advanced & Expert Users

Enterprise level Solaris&Windows file sharing

"Samba," I know, I know. However, I am a gov't worker and Samba is off the table. Does anyone have a recommendation for an off the shelf, secure solution? I've already suggested rsync and NFS services for Windows Server and got shot down. (4 Replies)
Discussion started by: LittleLebowski
4 Replies

3. Solaris

SMB + Windows sharing

Hi guys I need to create one directory on my Solaris 11 box and then share that directory on my LAN. I have only one disk of 500 GB which is more than enough for my needs. I read SMB guide for Solaris and there is no guide how to achive share only on one directory, it has only tutorials for... (3 Replies)
Discussion started by: solaris_user
3 Replies

4. Solaris

Problem in File/Dir sharing between a windows and solaris

Hi , We are trying to share a particular directory between solaris running from VMware installed on Win7 box] and windows box. We tried the SWAT utility of samba, and made all possible changes for sharing. We committed the changes and we were clueless what need to be done further.. referred... (0 Replies)
Discussion started by: BalajiUthira
0 Replies

5. HP-UX

mount windows file sharing on hp-ux

Hi all, Can anyone teach me how to mount windows file sharing on hp-ux thanks (2 Replies)
Discussion started by: pantas manik
2 Replies

6. Solaris

Windows/Solaris data sharing

Hi all, I have a request from Developer team in my compagny, they would like to be able to share data between unix and windows world. 1. We would like to be able to see Unix data from Windows : ?Samba ? 2 We would like to be able to see windows data from Solaris (Mount point) : ?NFS server... (4 Replies)
Discussion started by: unclefab
4 Replies

7. Linux

Please help me, about the file sharing with windows system

Did anybody can teach me how to set the premission in the samba server? How to i set the premission in one folder but two access right. With one folder but the user access rights is diffirent. One user can full access the folder, and another one user only read only. thx for helping... (1 Reply)
Discussion started by: cloudlor
1 Replies

8. Windows & DOS: Issues & Discussions

Windows Server 2003 file sharing with UNIX

We have a Windows Server 2003 box and I'd like to share a drive with a Sun Solaris box so that the Sun Solaris box can copy files to/from the Windows Server 2003. I believe that Windows Services for UNIX 3.5 will allow me to do this, can anyone comfirm this ? Also, any links on how to... (1 Reply)
Discussion started by: markgrimes
1 Replies
Login or Register to Ask a Question