Firewall Kills Samba

I've spent the past 2 days trying, for the second time, to get my Suse 9.3
Win2K lan to work with the firewall enabled.

Everything works fine with firewall off. Turn it on and NO workgroup
connections.

I've read thousands of threads on this issue so I know it's not just me.
None of the threads seemed to offer resolution of the issue except turn the
firewall off.

Yes ports 137 138 139 443 445 and 631 are open.

I've had good luck with solutions here before.

Anyone care to offer some suggestions?

anglers@texs.com wrote:

> Yes ports 137 138 139 443 445 and 631 are open.

With the firewall on? And from where are you checking this?

Anyway, FWIW, SMB or CIFS or whatever you want to kill it is a security
risk, so, most sensible firewalls close those ports immediately. Unless you
specifically instruct them not to...

--
Ruurd

> anglers@texs.com wrote:
>
> > Yes ports 137 138 139 443 445 and 631 are open.
>
> With the firewall on? And from where are you checking this?
>
> Anyway, FWIW, SMB or CIFS or whatever you want to kill it is a security
> risk, so, most sensible firewalls close those ports immediately. Unless you
> specifically instruct them not to...
>
> --
> Ruurd

With Firewall on looking in Yast etc/config Editor Network > Firewall >
Susefirewall2

FW_SERVICES_EXT_TCP
FW_SERVICES_EXT_UDP
FW_SERVICES_INT_TCP
FW_SERVICES_INT_UDP

After much research I've concluded SuseFirewall2 will only function if two
NICs are used, one for the LAN and one outside.

Since this isn't typical or practical in a home or small office real world
I'll have to rely on other firewall solutions, hardware and software.

A huge dissappointment for me as security is the main reason I've moved
from windows to linux. Sigh....

????

anglers@texs.com adjusted his/her tinfoil beanie to post:

> After much research I've concluded SuseFirewall2 will only function if
> two NICs are used, one for the LAN and one outside.
>
> Since this isn't typical or practical in a home or small office real
> world I'll have to rely on other firewall solutions, hardware and
> software.
>
> A huge dissappointment for me as security is the main reason I've
> moved
> from windows to linux. Sigh....
>
> ????

Hi Anglers,

Have you tried setting the same interface for internal and external?


--
Mark
Twixt hill and high water
N. Wales, UK
Novell Support Forums SysOp

On Sat, 24 Sep 2005 17:46:51 +0000, baskitcaise wrote:

> anglers@texs.com adjusted his/her tinfoil beanie to post:
>
>> After much research I've concluded SuseFirewall2 will only function if
>> two NICs are used, one for the LAN and one outside.
>>
>> Since this isn't typical or practical in a home or small office real
>> world I'll have to rely on other firewall solutions, hardware and
>> software.
>>
>> A huge dissappointment for me as security is the main reason I've
>> moved
>> from windows to linux. Sigh....
>>
>> ????
>
> Hi Anglers,
>
> Have you tried setting the same interface for internal and external?

Have you tried setting it up by editing
/etc/sysconfig/network/SuSEfirewall2?



--
Mark Robinson
Novell Volunteer SysOp

One by one the penguins steal my sanity...

anglers@texs.com wrote:

> After much research I've concluded SuseFirewall2 will only function if two
> NICs are used, one for the LAN and one outside.
>
> Since this isn't typical or practical in a home or small office real world
> I'll have to rely on other firewall solutions, hardware and software.
>
> A huge dissappointment for me as security is the main reason I've moved
> from windows to linux. Sigh....
>
> ????

Did you turn on logging of dropped and may be even accepted packages with
the firewall on. You should find dropped IP packages when Samba does not
work.

Did you set FW_TRUSTED_NETS in SuSEfirewall2?

--
Freek

anglers@texs.com adjusted his/her tinfoil beanie to post:

> After much research I've concluded SuseFirewall2 will only function if
> two NICs are used, one for the LAN and one outside.
>

I have setup SuSe with only one nic and have had samba working through
the firewall many a time, IIRC I put the same interface in the internal
and external boxes, you can then open up the local lan for whatever you
want.

However I do have a hardware firewall in my modem/router as well.


--
Mark
Twixt hill and high water
N. Wales, UK
Novell Support Forums SysOp

Thanks Mark but Yast only seems to allow either assigning my NIC to
external or internal but not both.

Is there some trick to doing that?

Have you tried setting it up by editing
/etc/sysconfig/network/SuSEfirewall2?

Yes