View Single Post
Old 1st January 2010
J65nko J65nko is offline
Administrator
 
Join Date: May 2008
Location: Budel - the Netherlands
Posts: 4,131
Default

Code:
an 01 12:27:18.772553 rule 141/(match) block in on rum0: 192.168.2.101.51276 > 192.168.2.255.137: udp 50
Jan 01 12:27:19.040897 rule 141/(match) block in on rum0: 192.168.2.101.51276 > 192.168.2.255.137: udp 50
Jan 01 12:27:19.999965 rule 141/(match) block in on rum0: 192.168.2.101.57817 > 192.168.2.254.192: udp 4
Jan 01 12:27:20.498712 rule 141/(match) block in on rum0: 192.168.2.101.55357 > 192.168.2.254.192: udp 4
Your firewall is blocking port 137, which is OK
Code:
$ grep 137 /etc/services
netbios-ns      137/tcp                         # NETBIOS Name Service
netbios-ns      137/udp
However port 192 seems to be used by Apple wireless stuff. See http://isc.sans.org/port.html?port=192.
Code:
Protocol	Service	Name
tcp	osu-nms	OSU Network Monitoring System
udp	osu-nms	OSU Network Monitoring System
And
Quote:
Port 192 UDP used by Apple AirPort Base Station PPP status or discovery (certain configurations), AirPort Admin Utility, AirPort Express Assistant Reference: http://support.apple.com/kb/TS1629
So blocking this might not be such a good idea
Add a rule to allow this port 192 traffic, and see whether that helps.
__________________
You don't need to be a genius to debug a pf.conf firewall ruleset, you just need the guts to run tcpdump
Reply With Quote