If you wish to run Samba on your firewall and access shares between the firewall and local hosts, you need the following rules:

#ACTION   SOURCE   DEST   PROTO    DPORT          SPORT
SMB(ACCEPT)  $FW      loc
SMB(ACCEPT)  loc      $FW

To pass traffic SMB/Samba traffic between zones Z1 and Z2:

#ACTION   SOURCE   DEST   PROTO    DPORT          SPORT
SMB(ACCEPT)  Z1       Z2
SMB(ACCEPT)  Z2       Z1

To make network browsing (“Network Neighborhood”) work properly between Z1 and Z2 requires a Windows Domain Controller and/or a WINS server. I have run Samba on my firewall to handle browsing between two zones connected to my firewall.

When debugging Samba/SMB problems, I recommend that you do the following:

The above steps will cause SMB traffic that is dropped or rejected by policy to be logged rather than handled silently.

If you are using Windows XP™ to test your setup,make you sure you have a properly configured client firewall .

You can just remove the copies and shorewall restart when you are finished debugging.