samba -- getting tougher!

[wuboy]

hi folks...

i'm having a bit of a problem with this setup.
basically i have a samba file server behind a firewall. now, i have redirected the netbios ports 137-139 to the machine behind the firewall using IPTables.

however, when i try to add a machine (a public machine) to the domain, it doesnt find it.
im not sure why, but am i missing something? do i need to forward more ports?

it's not secure to open up these ports, but i havent found a way around it yet.

thanks all

 

[StuckMojo]

joining a domain works by using broadcast. broadcast traffic doesn't get forwarded. thus it can't find the "domain controller" behind the firewall
AFAIK

 

[StuckMojo]

NT 4 domain, btw. active directory / win2k is supposed to work with DNS and thus can have a domain controller not on the same subnet (or so i hear)

 

[wuboy]

errrr, yah, i dunno. im not running active directory or anything with windows right now.

however, i have a samba server doing PDC behind the firewall. i'm not sure how public computers are able to access it yet. if the wiring were better, i'd put the workstations within the firewall, but it cannot be done now. so i have to figure out how to go around that for now.

stumped. like crazy. it's a cry for help on my end...

 

[n0cmonkey]

Its a *REALLY* bad idea to allow SMB traffic to pass your firewall.

 

[wuboy]

n0cmonkey,

yeah, i know that also. but i cant see any way around it. as soon as i know how to get it to work, i will limit it to IP address.

but please, does anyone know how to get it to work????? please?

 

[n0cmonkey]

sudo tcpdump -i eth0 host new_computers_ip

Then try adding the computer to your domain. See what ports it tries to use and make sure it is sending the information to the correct host.

 

[StuckMojo]

samba does NT4 style domains

AFAIK when a box wants to join the domain, it makes some kind of broadcast request asking for a domain controller (kinda like DHCP server discovery). broadcast traffic will not go thru a firewall. you would have to either bridge (bridges pass everything, routers dont), or maybe use proxy_arp (but that might not work)