iptables防火墙包含两部分,即位于用户空间的iptables模块和位于内核空间netfilter模块。用户空间模块提供插入、修改和除去包过滤表中规则,内核模块进行实际的过滤,所以更准确的名称应该是 iptables/netfilter。
iptables -m mac -h
修改/etc/samba/smb.conf
文件,首先添加要共享的目录:
[workspace] writable = yes path = /root/
如果打算使符号链接也可以访问,则在smb.conf的[global] 部分,添加如下配置:
follow symlinks = yes wide links = yes unix extensions = no
smbpasswd -a smbpasswd -e
# sed -i 's/SELINUX=enforcing/SELINUX=disabled/' /etc/selinux/config # setenforce 0 # reboot
[root@DDAN ~]# iptables -L --line-number Chain INPUT (policy ACCEPT) num target prot opt source destination 1 ACCEPT all -- anywhere anywhere 2 ACCEPT icmp -- anywhere anywhere 3 ACCEPT tcp -- anywhere anywhere tcp dpt:ssh 4 ACCEPT tcp -- anywhere anywhere tcp dpt:http 5 ACCEPT tcp -- anywhere anywhere tcp dpt:https 6 ACCEPT udp -- anywhere anywhere udp dpt:bootpc 7 ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED 8 DROP all -- anywhere anywhere
经查看,要添加到8号规则的前面,否则samba不起作用:
iptables -I INPUT 8 -p udp -m multiport --dport 137,138 -j ACCEPT iptables -I INPUT 8 -p tcp -m state --state NEW -m multiport --dport 139,445 -j ACCEPT
[root@DDAN ~]# iptables -L --line-number -n Chain INPUT (policy ACCEPT) num target prot opt source destination 1 ACCEPT all -- 0.0.0.0/0 2 ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 3 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 4 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 5 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:443 6 ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:68 7 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 8 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW multiport dports 139,445 9 ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 137,138 10 DROP all -- 0.0.0.0/0 0.0.0.0/0
#保存规则 service iptables save #启用smb: service smb restart #使smb随机器启动 chkconfig smb on
也可以使用iptables -F
完全删除规则