Debian
Debian 9：Samba 和 SMTP 的 Iptables 無法正常工作
我目前正在嘗試為 Samba 打開 iptables 防火牆，但我在不同門戶上找到的配置不起作用。沒有防火牆，一切正常。啟用防火牆後，除了 nmbd.log 之外，我在日誌中看不到任何錯誤。
[2017/07/24 15:07:47.107717, 0] ../source3/libsmb/nmblib.c:873(send_udp) Packet send failed to 192.168.0.46(137) ERRNO=Operation not permitted [2017/07/24 15:07:47.107808, 0] ../source3/nmbd/nmbd_packets.c:1026(reply_netbios_packet) reply_netbios_packet: send_packet to IP 192.168.0.46 port 137 failed [2017/07/24 15:10:30.841301, 0] ../source3/libsmb/nmblib.c:873(send_udp) Packet send failed to 192.168.0.255(137) ERRNO=Operation not permitted [2017/07/24 15:10:30.841395, 0] ../source3/nmbd/nmbd_packets.c:179(send_netbios_packet) send_netbios_packet: send_packet() to IP 192.168.0.255 port 137 failed [2017/07/24 15:10:30.841421, 0] ../source3/nmbd/nmbd_namequery.c:245(query_name) query_name: Failed to send packet trying to query name WORKGROUP<1d> [2017/07/24 15:12:34.203550, 0] ../source3/libsmb/nmblib.c:873(send_udp) Packet send failed to 192.168.0.255(138) ERRNO=Operation not permitted [2017/07/24 15:12:34.203669, 0] ../source3/libsmb/nmblib.c:873(send_udp) Packet send failed to 192.168.0.255(138) ERRNO=Operation not permittedsamba 所需的所有埠都在監聽。
xyz@nuc:~# netstat -tulpn | egrep "samba|smbd|nmbd|winbind" tcp 0 0 0.0.0.0:139 0.0.0.0:* LISTEN 517/smbd tcp 0 0 0.0.0.0:445 0.0.0.0:* LISTEN 517/smbd tcp6 0 0 :::139 :::* LISTEN 517/smbd tcp6 0 0 :::445 :::* LISTEN 517/smbd udp 0 0 192.168.0.255:137 0.0.0.0:* 576/nmbd udp 0 0 192.168.0.2:137 0.0.0.0:* 576/nmbd udp 0 0 192.168.0.255:137 0.0.0.0:* 576/nmbd udp 0 0 192.168.0.249:137 0.0.0.0:* 576/nmbd udp 0 0 0.0.0.0:137 0.0.0.0:* 576/nmbd udp 0 0 192.168.0.255:138 0.0.0.0:* 576/nmbd udp 0 0 192.168.0.2:138 0.0.0.0:* 576/nmbd udp 0 0 192.168.0.255:138 0.0.0.0:* 576/nmbd udp 0 0 192.168.0.249:138 0.0.0.0:* 576/nmbd udp 0 0 0.0.0.0:138 0.0.0.0:* 576/nmbd現在的 iptables 配置：
iptables -F iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P FORWARD DROP #Allow traffic on loopback iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT #dhcp iptables -I INPUT -i enp0s25 -p udp --dport 67:68 --sport 67:68 -j ACCEPT #Incoming ssh connection (server) iptables -A INPUT -i enp0s25 -p tcp --dport 2222 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -o enp0s25 -p tcp --sport 2222 -m state --state ESTABLISHED -j ACCEPT #Outgoing ssh connection (client) iptables -A OUTPUT -o enp0s25 -p tcp --dport 2222 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i enp0s25 -p tcp --sport 2222 -m state --state ESTABLISHED -j ACCEPT ##PING INCOMING ICMP iptables -A INPUT -p icmp --icmp-type 8 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT iptables -A OUTPUT -p icmp --icmp-type 0 -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A OUTPUT -p icmp --icmp-type 8 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -p icmp --icmp-type 0 -m state --state ESTABLISHED,RELATED -j ACCEPT ##SMTP## #iptables -A OUTPUT -p tcp --sport 25 -m conntrack --ctstate ESTABLISHED -j ACCEPT #iptables -A OUTPUT -p tcp --dport 25 -j ACCEPT #iptables -A INPUT -p tcp --sport 25 -m state --state ESTABLISHED -j ACCEPT iptables -A INPUT -p tcp --dport 25 -j ACCEPT iptables -A INPUT -p tcp --dport 587 -j ACCEPT iptables -A INPUT -p tcp --dport 465 -j ACCEPT ##SMB iptables -A INPUT -i enp0s25 -p udp --dport 137:138 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -o enp0s25 -p udp --sport 137:138 -m state --state ESTABLISHED -j ACCEPT iptables -A INPUT -i enp0s25 -p tcp --dport 139 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -o enp0s25 -p tcp --sport 139 -m state --state ESTABLISHED -j ACCEPT iptables -A OUTPUT -o enp0s25 -p udp --sport 445 -m state --state ESTABLISHED -j ACCEPT #iptables -A OUTPUT -m state --state NEW,ESTABLISHED -p udp --dport 137 -j ACCEPT #iptables -A OUTPUT -m state --state NEW,ESTABLISHED -p udp --dport 138 -j ACCEPT #iptables -A OUTPUT -m state --state NEW,ESTABLISHED -p tcp --dport 139 -j ACCEPT #iptables -A OUTPUT -m state --state NEW,ESTABLISHED -p tcp --dport 445 -j ACCEPT #iptables -A INPUT -p udp -m udp --dport 137 -j ACCEPT #iptables -A INPUT -p udp -m udp --dport 138 -j ACCEPT #iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 139 -j ACCEPT #iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 445 -j ACCEPT #iptables -A INPUT -p tcp -m multiport --dport 139,445 -j ACCEPT #iptables -A INPUT -p udp -m multiport --dport 137,138 -j ACCEPT #iptables -A OUTPUT -p tcp -m multiport --dport 139,445 -j ACCEPT #iptables -A OUTPUT -p udp -m multiport --dport 137,138 -j ACCEPT #iptables -A INPUT -p udp -m udp --dport 137 -j ACCEPT #iptables -A INPUT -p udp -m udp --dport 138 -j ACCEPT #iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 139 -j ACCEPT #iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 445 -j ACCEPT #Allow apt-get requests (HTTP) iptables -A OUTPUT -p tcp --dport 80 --sport 32768:61000 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -p tcp --sport 80 --dport 32768:61000 -m state --state ESTABLISHED -j ACCEPT iptables -A OUTPUT -p udp --dport 53 --sport 32768:61000 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -p udp --sport 53 --dport 32768:61000 -m state --state ESTABLISHED -j ACCEPT iptables -A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7有人可以給我一個提示，我怎樣才能正確地為 SMTP 和 samba 設置 iptables？
最好的祝福
咖啡
錯誤日誌中顯示的以下行表示機器無法將 UDP 數據包發送到埠 137（被防火牆丟棄）。因此，您需要為 UDP 添加 ACCEPT 規則以允許該埠。
[2017/07/24 15:07:47.107717, 0] ../source3/libsmb/nmblib.c:873(send_udp) Packet send failed to 192.168.0.46(137) ERRNO=Operation not permitted同樣，UDP 埠 138 有錯誤。這些是 NetBios 埠。添加如下規則：
iptables -A OUTPUT -p udp --dport 137 -j ACCEPT iptables -A OUTPUT -p udp --dport 138 -j ACCEPT