Odi's astoundingly incomplete notes
New entries | CodeSlow to connect to Samba? Check your packet filter!
I am currently setting up a simple new Samba server on Gentoo. A Windows XP box took forever to connect to the share however. The reason for this is interesting. Apparently the Windows SMB client first tries to access the remote server via WebDAV (HTTP). But on the Samba box there is no HTTP server. Instead an
iptables
rule is in place to reject connections for non-open ports:
-A INPUT -p tcp -m tcp --syn -j REJECT --reject-with icmp-port-unreachableThe long timeout is easily reproducible on a Windows console with
telnet
. Of course you would expect timeouts when using a DROP target, as the client is not informed that the port is not open. So I was trying to be clever and send an ICMP message to inform the client. Turns out this is wrong. Closed TCP ports should send a RST packet instead:
-A INPUT -p tcp -m tcp --syn -j REJECT --reject-with tcp-resetThe complete chain of rules (at the end of the rule set) for correctly dropping packets is:
# drop broadcast packets -A INPUT -m pkttype --pkt-type broadcast -j DROP # TCP ports that are not open -A INPUT -p tcp -m tcp --syn -j REJECT --reject-with tcp-reset # reply with reject to closed UDP ports -A INPUT -p udp -j REJECT # drop rest -A INPUT -j DROP
and ip(such as 192.168.1.3) your_hostname