# Yunohost firewall and custom iptables rules, ports on networks, samba behind vpn **URL:** https://forum.yunohost.org/t/yunohost-firewall-and-custom-iptables-rules-ports-on-networks-samba-behind-vpn/23194 **Category:** Advanced use case **Tags:** wireguard\_client, yunohost-firewall, english **Created:** [January 20, 2023, 2:22am UTC](https://forum.yunohost.org/t/yunohost-firewall-and-custom-iptables-rules-ports-on-networks-samba-behind-vpn/23194 "2023-01-20T02:22:21Z") **Posts on this page:** 2 **Page:** 1
### Author: ![jorge](https://forum.yunohost.org/user_avatar/forum.yunohost.org/jorge/32/3293_2.png) [@jorge](https://forum.yunohost.org/u/jorge) #### Post date: [January 20, 2023, 2:22am UTC](https://forum.yunohost.org/t/yunohost-firewall-and-custom-iptables-rules-ports-on-networks-samba-behind-vpn/23194/1 "2023-01-20T02:22:22Z")
#en I would love to get some help. I have already read and checked this other posts: - [How to turn YunoHost into a NAS with Samba - #7 by ljf](https://forum.yunohost.org/t/how-to-turn-yunohost-into-a-nas-with-samba/18034/7) - [Best practice to add custom IPtables?](https://forum.yunohost.org/t/best-practice-to-add-custom-iptables/10238) - [[SOLVED] Yunohost firewall reload deletes custom rules](https://forum.yunohost.org/t/solved-yunohost-firewall-reload-deletes-custom-rules/22173) My goal is to put samba behind a vpn. This should work with smb.conf or/and firewall for security reasons. I am trying to get samba to work only on a behind a vpn/wireguard sub network but the firewall rules neither `smb.conf` networking restriction rules such as `host allow`, `host deny` and `interfaces` do apply. ```auto [global] log file = /var/log/samba/log.%m max log size = 1000 logging = file panic action = /usr/share/samba/panic-action %d server role = standalone server obey pam restrictions = yes unix password sync = yes passwd program = /usr/bin/passwd %u passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* . pam password change = yes map to guest = bad user usershare allow guests = yes idmap config * : backend = tdb workgroup = WORKGROUP interfaces = lo enp2s0 127.0.0.0/8 10.22.10.0/24 bind interfaces only = yes host allow = 127.0.0.1 10.22.10.0/24 host deny = 0.0.0.0/0 [sambashared] comment = SAMBASHAREFOLDER read only = no path = /home/shared/server browsable = yes valid users = force create mode = 0775 force directory mode = 0775 guest ok = no guest only = no ``` If I opent ports with `yunohost firewall allow TCP 445` i get samba working, but on all IP range. It is no applying `host deny = 0.0.0.0/0` I can see the rules applied running `iptables -nvL ` ```auto Chain INPUT (policy DROP 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 12 836 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:25 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:53 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:443 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:587 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:993 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:2222 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:445 0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:53 0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:5353 0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:8096 0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination ``` * * * After doing: `yunohost firewall disallow Both 445` Uncomenting the custom rules that are written in: `/etc/yunohost/hooks.d/post_iptable_rules/99-samba_custom` ```auto #!/bin/bash iptables -A INPUT -s 10.22.10.0/24 -p udp -m udp --dport 137 -j ACCEPT iptables -A INPUT -s 10.22.10.0/24 -p udp -m udp --dport 138 -j ACCEPT iptables -A INPUT -s 10.22.10.0/24 -p tcp -m tcp --dport 139 -j ACCEPT iptables -A INPUT -s 10.22.10.0/24 -p tcp -m tcp --dport 445 -j ACCEPT ``` Appling new filters either with `yunohost firewall reload` or `systemctl restart yunohost-firewall.service` Checking changes in iptables: ```auto iptables -nvL Chain INPUT (policy DROP 12 packets, 522 bytes) pkts bytes target prot opt in out source destination 286 37978 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:25 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:53 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:443 1 52 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:587 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:993 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:2222 6 445 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:53 0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:5353 0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:8096 8 480 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 0 0 ACCEPT udp -- * * 10.22.10.0/24 0.0.0.0/0 udp dpt:137 0 0 ACCEPT udp -- * * 10.22.10.0/24 0.0.0.0/0 udp dpt:138 0 0 ACCEPT tcp -- * * 10.22.10.0/24 0.0.0.0/0 tcp dpt:139 0 0 ACCEPT tcp -- * * 10.22.10.0/24 0.0.0.0/0 tcp dpt:445 Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination ``` And samba will not succeed. With this error ```auto do_connect: Connection to oficina.biciclot.coop failed (Error NT_STATUS_IO_TIMEOUT) ``` ---
### Author: ![system](https://forum.yunohost.org/uploads/default/original/2X/f/f59fe8e3ee6b100b4f574d30d6e30479c68b89f0.png) [@system](https://forum.yunohost.org/u/system) #### Post date: [February 19, 2023, 2:23am UTC](https://forum.yunohost.org/t/yunohost-firewall-and-custom-iptables-rules-ports-on-networks-samba-behind-vpn/23194/2 "2023-02-19T02:23:09Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.