Subject: Windows-Shares through Fwtk

From: [email-masked]
Date: Tue, 14 Mar 2000 16:25:13 +0100

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Hi !

I've got a problem with getting Windows shares
through our FWTK Firewall.
The only thing I need is the possibility to get shares through
the Firewall.

I heard something about udprelay, installed it,
but it doesn't seem to work as needed.

Do I really need UDP relay? What other configurations
need to be done?

I would be glad if you anyone could tell me which way to
go. :-)

My Configuration is as follows:

Internal Net 0   ------    Firewall   -------   Internal Net 1

PC1 : 192.168.0.99   Which has the Shares
PC2 : 196.195.0.88   Which needs the Shares
Firewall: 192.168.0.3  and 196.195.0.10

If I need a plug-gw, where must I plug PC2 to ?

Thanks.  :-))

CU dw.

---

From: Rick Murphy <[email-masked]>
Date: Tue, 14 Mar 2000 16:56:00 -0500

>through our FWTK Firewall.

Good! That means it's working as intended :-)

>The only thing I need is the possibility to get shares through

NetBIOS uses ports 137 UDP (nbname), 138 UDP (nbdatagram) and 139 TCP 
(nbsession).
The only one that you can do anything with using just FWTK stuff is the 
session service, 139 TCP. Ports 137 and 138 must go through packet filtered 
or some other way; the addresses must be exposed on both since the data 
requests (nbdatagram) have the address to respond to embedded in the data 
portion.
Bottom line: use scp or something else to shuffle your data through the 
firewall. You can't secure NetBIOS.
         -Rick

---

From: [email-masked]
Date: Wed, 15 Mar 2000 05:46:17 -0500 (EST)

>>>>> "Rick" == Rick Murphy <[email-masked]> writes:

>> The only thing I need is the possibility to get shares through

Rick> NetBIOS uses ports 137 UDP (nbname), 138 UDP (nbdatagram) and 139 TCP 
Rick> (nbsession).
Rick> The only one that you can do anything with using just FWTK stuff is the 
Rick> session service, 139 TCP. Ports 137 and 138 must go through packet filtered 
Rick> or some other way; the addresses must be exposed on both since the data 
Rick> requests (nbdatagram) have the address to respond to embedded in the data 
Rick> portion.
Rick> Bottom line: use scp or something else to shuffle your data through the 
Rick> firewall. You can't secure NetBIOS.

Now, now - the above is not _strictly_ true. If you plug port 139/tcp from
the bastion to your file server, and add the bastion's IP address as the
server's in the client's LMHOSTS file, you can successfully mount a CIFS
share. Of course, if you want more than one server, you'll either have to
implement transparancy, or use virtual IP addresses, as the port must be 139
(at least via the GUI - anyone know if you can NET USE a share on an
alternate port? I don't think so, but I could be wrong.)

Of course, the security (or lack thereof) of the above-mentioned config is a
definite issue. But it _is_ possible.

-- 
Carson Gaspar -- [email-masked] [email-masked] [email-masked]
http://www.cs.columbia.edu/~carson/home.html
Queen Trapped in a Butch Body