trying to bind samba / named to local interfaces only

[kif]

I've just installed RH 8.0 to act as a gateway for my home LAN and I'm now doing the basic security thing - closing all the ports not in use, and setting the ones that are to only bind to the LAN interfaces.

I'm almost done, but I've a couple of questions about services that I can't seem to set to ignore the external interface.

- In named.conf I've set listen-on to the local interfaces. But, while netstat shows that it is bound to them on 53/tcp and 53/udp, it still reports named as also listening on 1024/udp. Am I missing something, or does named need this extra udp port open?

- I'm also running samba, and in smb.conf I've again set the interfaces to the local net and set "bind interfaces only" as well. Netstat (and fuser) shows me that the smbd bit of samba is bound only to my LAN on 139/tcp but that nmbd is bound twice on both 137/udp and 138/udp - once to the local interfaces and again on all interfaces. How can I get rid of the extra bindings?

Why is tcp behaving as I want it to, but not udp? Why do we need both protocols anyway?

cheers

[filp]

Why are you running these services if you want them to ignore the external interface?

Probably the easiest / most scalable way of controlling access to the external interface is with a firewall. Not the bodgy one that RedHat installs, learn to roll your own. It's quite easy. Just post if you have any problems ( after checking with google).

Seeya,
Filp.

[kif]

Well, surely samba shouldn't have anything to do with the external interface - it's not as if I'm running a WAN or anything, just a service for the 2 windows boxes on my LAN.

I've found out that named uses ports above 1023/udp as a "back-channel" - which makes sense (or I'd find that I wouldn't get any DNS replies) but I didn't expect to port to remain open after any DNS queries had been answered.

I am running iptables (from a mix of sample configs I've found on the net) to catch any ports that I couldn't close, but I don't have that much confidence in my firewall rules just yet and would rather cut traffic out before it tests whether I've got the rules right...

I've also just been pointed in the direction of one of the better tutorials I've seen on iptables - http://iptables-tutorial.frozentux.net/iptables-tutorial.html - so I'll probably end up rolling my own anyway.

cheers