Исходное сообщение
"iptables и 135-139 ports не дропает" Отправлено mad_user, 17-Авг-05 14:00
Это tcpdump от внешнего ифейса ( на INET GW ) debian:/proc/sys/net/ipv4# tcpdump -i eth1 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth1, link-type EN10MB (Ethernet), capture size 96 bytes 13:49:18.930712 arp who-has 10.1.1.2 tell 10.1.1.3 13:49:18.931428 arp who-has 10.1.1.1 tell debian.WG_RAS 13:49:18.955630 IP 10.1.1.3.netbios-ns > 10.1.1.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST 13:49:18.955758 arp who-has 10.1.1.3 tell 10.1.1.10 13:49:21.267665 IP 10.1.1.23.netbios-ns > 10.1.1.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST 13:49:21.490805 IP 10.1.1.28.netbios-ns > 10.1.1.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST 13:49:21.602843 IP 10.1.1.15.netbios-ns > 10.1.1.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST 13:49:22.016887 IP 10.1.1.23.netbios-ns > 10.1.1.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST 13:49:22.236255 IP 10.1.1.28.netbios-ns > 10.1.1.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST 13:49:22.346464 IP 10.1.1.15.netbios-ns > 10.1.1.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST 13:49:22.767926 IP 10.1.1.23.netbios-ns > 10.1.1.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST 11 packets captured 11 packets received by filter 0 packets dropped by kernel правила IPTABLES ( могут быть не верными,я еще плохо разбираюсь, но пишет, что дропают ) #!/bin/bash echo "1" > /proc/sys/net/ipv4/ip_forward #iptables -P INPUT DROP #iptables -P OUTPUT DROP #iptables -P FORWARD DROP iptables -I INPUT -p UDP -i eth0 --sport 137:139 -j DROP iptables -I INPUT -p UDP -i eth0 --dport 137:139 -j DROP iptables -I FORWARD -p UDP -i eth0 --sport 137:139 -j DROP iptables -I FORWARD -p UDP -i eth0 --dport 137:139 -j DROP iptables -I OUTPUT -p UDP --sport 137:139 -j DROP iptables -I OUTPUT -p UDP --dport 137:139 -j DROP iptables -I INPUT -p UDP --sport 137:139 -j DROP iptables -I INPUT -p UDP --dport 137:139 -j DROP iptables -I FORWARD -p UDP --sport 137:139 -j DROP iptables -I FORWARD -p UDP --dport 137:139 -j DROP debian:/config# iptables -nvxL Chain INPUT (policy ACCEPT 6299 packets, 299756 bytes)     pkts      bytes target     prot opt in     out     source               destination      602    48164 DROP       udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp spts:137:139        0        0 DROP       udp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           udp spts:137:139    24035  1926301 DROP       udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpts:137:139        0        0 DROP       udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp spts:137:139        0        0 DROP       udp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           udp dpts:137:139        0        0 DROP       udp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           udp spts:137:139      121     9589 DROP       udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpts:137:139        0        0 DROP       udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp spts:137:139        0        0 DROP       udp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           udp dpts:137:139        0        0 DROP       udp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           udp spts:137:139 Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)     pkts      bytes target     prot opt in     out     source               destination        0        0 DROP       udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpts:137:139        0        0 DROP       udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp spts:137:139        0        0 DROP       udp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           udp dpts:137:139        0        0 DROP       udp  --  eth0   *       0.0.0.0/0            0.0.0.0/0           udp spts:137:139 Chain OUTPUT (policy ACCEPT 11283 packets, 2555057 bytes)     pkts      bytes target     prot opt in     out     source               destination        0        0 DROP       udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpts:137:139        0        0 DROP       udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp spts:137:139        0        0 DROP       udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpts:137:139        0        0 DROP       udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp spts:137:139 debian:/config#