Firewall to block smb network share

[bishal]

Hi I have NS5 running in APWDS and in client end STAWDS running in bridge mode. How can I block smb port with firewall so that clients cannot see each other network share folder? The rules I have applied doesn't seem to work.


Firewall Rules

Bridge table: filter

Bridge chain: FIREWALL, entries: 6, policy: ACCEPT
-p IPv4 --ip-src 0.0.0.0 --ip-dst 0.0.0.0 --ip-proto tcp --ip-sport 135 --ip-dport 135 -j DROP , pcnt = 0 -- bcnt = 0
-p IPv4 --ip-src 0.0.0.0 --ip-dst 0.0.0.0 --ip-proto tcp --ip-sport 139 --ip-dport 139 -j DROP , pcnt = 0 -- bcnt = 0
-p IPv4 --ip-src 0.0.0.0 --ip-dst 0.0.0.0 --ip-proto tcp --ip-sport 445 --ip-dport 445 -j DROP , pcnt = 0 -- bcnt = 0
-p IPv4 --ip-src 0.0.0.0 --ip-dst 0.0.0.0 --ip-proto udp --ip-sport 135 --ip-dport 135 -j DROP , pcnt = 0 -- bcnt = 0
-p IPv4 --ip-src 0.0.0.0 --ip-dst 0.0.0.0 --ip-proto udp --ip-sport 139 --ip-dport 139 -j DROP , pcnt = 0 -- bcnt = 0
-p IPv4 --ip-src 0.0.0.0 --ip-dst 0.0.0.0 --ip-proto udp --ip-sport 445 --ip-dport 445 -j DROP , pcnt = 0 -- bcnt = 0

[UBNT-keba]

netbios-ns 137/tcp # NETBIOS Name Service
netbios-ns 137/udp
netbios-dgm 138/tcp # NETBIOS Datagram Service
netbios-dgm 138/udp
netbios-ssn 139/tcp # NETBIOS session service
netbios-ssn 139/udp

Be should that you used 0.0.0.0/0 for rules that applies to any IP.
Also the rules for bridge mode should be kind of these:

ebtables -A FORWARD -p IPv4 --ip-src 0.0.0.0/0 --ip-dst 0.0.0.0/0 --ip-proto tcp --ip-sport 137:139 -j DROP
ebtables -A FORWARD -p IPv4 --ip-src 0.0.0.0/0 --ip-dst 0.0.0.0/0 --ip-proto tcp --ip-dport 137:139 -j DROP
ebtables -A FORWARD -p IPv4 --ip-src 0.0.0.0/0 --ip-dst 0.0.0.0/0 --ip-proto tcp --ip-sport 445 -j DROP
ebtables -A FORWARD -p IPv4 --ip-src 0.0.0.0/0 --ip-dst 0.0.0.0/0 --ip-proto tcp --ip-dport 445 -j DROP

ebtables -A FORWARD -p IPv4 --ip-src 0.0.0.0/0 --ip-dst 0.0.0.0/0 --ip-proto udp --ip-sport 137:139 -j DROP
ebtables -A FORWARD -p IPv4 --ip-src 0.0.0.0/0 --ip-dst 0.0.0.0/0 --ip-proto udp --ip-dport 137:139 -j DROP
ebtables -A FORWARD -p IPv4 --ip-src 0.0.0.0/0 --ip-dst 0.0.0.0/0 --ip-proto udp --ip-sport 445 -j DROP
ebtables -A FORWARD -p IPv4 --ip-src 0.0.0.0/0 --ip-dst 0.0.0.0/0 --ip-proto udp --ip-dport 445 -j DROP

You can do the same thing through Web UI as well. Go to Network tab Enable Firewall: Configure...