iptables (проверьте правила!)

[kkkggg]

#!/bin/bash
IPTABLES='/sbin/iptables'
NET='eth0'
SATELITE='dvb_0'

$IPTABLES -P FORWARD DROP
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT DROP
$IPTABLES -P allowed_squid DROP

$IPTABLES -N allowed_squid
$IPTABLES -A allowed_squid -s 127.0.0.1/8 -j ACCEPT
$IPTABLES -A allowed_squid -s 192.168.11.211 -j ACCEPT

#=======INPUT==============
$IPTABLES -t filter -A INPUT -p tcp -i $NET --sport 80 -j ACCEPT
$IPTABLES -t filter -A INPUT -p tcp -i $NET --sport 139 -j ACCEPT
$IPTABLES -t filter -A INPUT -p tcp -i $NET --sport 445 -j ACCEPT
$IPTABLES -t filter -A INPUT -p tcp -i $NET --sport 3128 -j allowed_squid
$IPTABLES -t filter -A INPUT -p ALL -i $SATELITE -j ACCEPT

#=======OUTPUT=============
$IPTABLES -t filter -A OUTPUT -p tcp -o $NET --dport 139 -j ACCEPT
$IPTABLES -t filter -A OUTPUT -p tcp -o $NET --dport 445 -j ACCEPT
$IPTABLES -t filter -A OUTPUT -p tcp -o lo --dport 3128 -j allowed_squid
$IPTABLES -t filter -A OUTPUT -p ALL -o ppp0 -j ACCEPT
$IPTABLES -t filter -A OUTPUT -p ALL -o ppp1 -j ACCEPT

После загрузки сего в ядро, я не могу зайти в сеть(samba).

[alfamayonez]

#!/bin/bash
IPTABLES='/sbin/iptables'
NET='eth0'
SATELITE='dvb_0'

$IPTABLES -P FORWARD DROP
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT DROP
$IPTABLES -P allowed_squid DROP

$IPTABLES -N allowed_squid
$IPTABLES -A allowed_squid -s 127.0.0.1/8 -j ACCEPT
$IPTABLES -A allowed_squid -s 192.168.11.211 -j ACCEPT

#=======INPUT==============
$IPTABLES -t filter -A INPUT -p tcp -i $NET --sport 80 -j ACCEPT
$IPTABLES -t filter -A INPUT -p tcp -i $NET --sport 139 -j ACCEPT
$IPTABLES -t filter -A INPUT -p tcp -i $NET --sport 445 -j ACCEPT
$IPTABLES -t filter -A INPUT -p tcp -i $NET --sport 3128 -j allowed_squid
$IPTABLES -t filter -A INPUT -p ALL -i $SATELITE -j ACCEPT

#=======OUTPUT=============
$IPTABLES -t filter -A OUTPUT -p tcp -o $NET --dport 139 -j ACCEPT
$IPTABLES -t filter -A OUTPUT -p tcp -o $NET --dport 445 -j ACCEPT
$IPTABLES -t filter -A OUTPUT -p tcp -o lo --dport 3128 -j allowed_squid
$IPTABLES -t filter -A OUTPUT -p ALL -o ppp0 -j ACCEPT
$IPTABLES -t filter -A OUTPUT -p ALL -o ppp1 -j ACCEPT

После загрузки сего в ядро, я не могу зайти в сеть(samba).

Неуверен конечно, но попробуй еще разрешить 135 порт...

[admiral]

На сайте самбы написано:

Using a Firewall

Many people use a firewall to deny access to services they do not want exposed outside their network. This can be a good idea, although I recommend using it in conjunction with the above methods so you are protected even if your firewall is not active for some reason.

If you are setting up a firewall, you need to know what TCP and UDP ports to allow and block. Samba uses the following: Port 135/TCP - used by smbd
Port 137/UDP - used by nmbd
Port 138/UDP - used by nmbd
Port 139/TCP - used by smbd
Port 445/TCP - used by smbd


The last one is important because many older firewall setups may not be aware of it, given that this port was only added to the protocol in recent years.

When configuring a firewall, the high order ports (1024-65535) are often used for outgoing connections and therefore should be permitted through the firewall. It is prudent to block incoming packets on the high order ports except for established connections.