# Ipfw 3 ifaces and samba



## Nortpic (Jan 23, 2012)

I have a server. The server has three interfaces, one for the internet (re0) and two other for the LAN. They are both in the same LAN (both in one switch). One of them (re1) is a gateway, DHCP server and so on. And other one has a samba server binded (em0). A have a problem - Ii need all traffic for a samba to go throught em0 and all other traffic through re1.
*ifconfig*

```
em0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
   options=219b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,TSO4,WOL_MAGIC>
   ether 00:15:17:6e:e9:bc
   inet 192.168.0.253 netmask 0xffffffff broadcast 192.168.0.253
   media: Ethernet autoselect (100baseTX <full-duplex>)
   status: active
re0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
   options=389b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,WOL_UCAST,WOL_MCAST,WOL_MAGIC>
   ether d8:5d:4c:80:ce:3e
   inet 192.168.1.173 netmask 0xffffff00 broadcast 192.168.1.255
   media: Ethernet autoselect (100baseTX <full-duplex>)
   status: active
re1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
   options=389b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,WOL_UCAST,WOL_MCAST,WOL_MAGIC>
   ether d8:5d:4c:80:de:8b
   inet 192.168.0.254 netmask 0xffffff00 broadcast 192.168.0.255
   media: Ethernet autoselect (100baseTX <full-duplex>)
   status: active
ipfw0: flags=8801<UP,SIMPLEX,MULTICAST> metric 0 mtu 65536
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
   options=3<RXCSUM,TXCSUM>
   inet6 fe80::1%lo0 prefixlen 64 scopeid 0x5
   inet6 ::1 prefixlen 128
   inet 127.0.0.1 netmask 0xff000000
   nd6 options=3<PERFORMNUD,ACCEPT_RTADV>
```
As you can see re1 is 192.168.0.254/24 and em0 192.168.0.253/32

routing table

```
Internet:
Destination        Gateway            Flags    Refs      Use  Netif Expire
default            192.168.1.254      UGS        18     8374    re0
localhost          link#5             UH          0      352    lo0
192.168.0.0        link#3             U           3     4934    re1
192.168.0.253      link#1             UHS         0        0    lo0 =>
192.168.0.253/32   link#1             U           0        0    em0
192.168.0.254      link#3             UHS         0        0    lo0
192.168.1.0        link#2             U           0        0    re0
192.168.1.173      link#2             UHS         0        0    lo0

Internet6:
Destination        Gateway            Flags      Netif Expire
localhost          localhost          UH          lo0
fe80::%lo0         link#5             U           lo0
fe80::1%lo0        link#5             UHS         lo0
ff01:5::           fe80::1%lo0        U           lo0
ff02::%lo0         fe80::1%lo0        U           lo0
```
*ipfw show*

```
00100 12766 4169767 pipe 1 ip from any to any
00101     0       0 queue 1 ip from any to any proto udp dst-port 5060 via re0
00102  6013 2025096 queue 2 ip from any to any via re0
00103  1945  340890 fwd 127.0.0.1,3128 ip from any to any dst-port 80,81,8080 via re1
00104     0       0 fwd 192.168.0.253,137 ip from any to 192.168.0.253
04000  2802 1525064 netgraph 2 ip from any to 192.168.1.173 via re0 in
04001     0       0 netgraph 1 ip from 192.168.0.254 to any via re0 out
04001     0       0 netgraph 1 icmp from 192.168.0.0/24 to any via re0 out
04001   843  111772 netgraph 1 ip from 192.168.0.0/24 to any dst-port 53,5170,5060,21-50,143,993,110,587,443 via re0 out
65535 10895 3837648 allow ip from any to any
```
smb.conf (via *testparm*) 

```
[global]
   workgroup = MEDIA
   server string = main_server
   interfaces = 192.168.0.253/32
   bind interfaces only = Yes
   security = SHARE
   log file = /var/log/samba/log.%m
   max log size = 50
   preferred master = Yes
   domain master = Yes
   dns proxy = No
   idmap config * : backend = tdb

[homes]
   comment = Home Directories
   read only = No
   browseable = No

[workfold]
   comment = Main folder
   path = /home/samba/main
   read only = No
   guest ok = Yes
```
When the computer in the network tries to connect to the samba server the traffic goes throught the em0, but when they are starting download I see all the traffic throught the re1. Please, show me the way!

Regards, Nortpic


----------



## qsecofr (Jan 25, 2012)

Do the Samba clients connect to the host by IP address or by host name?  If by hostname, does it resolve to 1 single IP address or many?  And double check if you've specified in your rule set all the port numbers that Samba uses.  Looks like rule 104 might be the rule you intended to process all Samba traffic, but it doesn't appear to have logged any packet counts.


----------

