Forwarded ports not visible from outside the network

Question

I have done a bit of port-forwarding before with success, but suddenly I encountered this problem that I do not know how to solve. I am hosting a samba share on port 137-139 and 445, and accessing the device via its local IP address (192.168.x.x) address works fine -- I can view the shares.

However, when I port-forward the correct ports in my router from the correct local IP address and access it via my public IP address, it works fine; but when anyone else tries to, the ports look closed. No online port scanner, nor friends I have contacted can connect to the share or see the open ports, even when using the exact same commands as me and my public IP. I am guessing my router supports hair-pinning since I can access my public IP at all times, but why would it behave differently for me compared to anyone else when using my public IP address?

My router model is ASUS RT-AC85P and I am hosting the share on a Raspberry Pi 3 Model B+. I have been able to port-forward before, so it is not a problem with my ISP, rather my router since I relatively recently changed it.

Answer 1

why would it behave differently for me compared to anyone else when using my public IP adress?

It could be that the RPi has IP-based firewall rules, as suggested in comments, but I suspect that it's your ISP blocking the connection – many ISPs block ports 137-139 and 445 specifically, even if they don't block anything else. (The Windows built-in SMB service was a major attack target several times, so they don't want to take the chances.)

When you're accessing your own public IP address, you're just talking directly to the router and not going through the ISP's connection. (Which is part of the reason why routers need specific support for hairpinning.) On the other hand, when you're connecting from the outside, then ISP filtering applies and the packets aren't even reaching the router in the first place, so your port-forward rules can do nothing about it.

If you need to access the server remotely (and if it must be over SMB), set up a VPN into your home network. Otherwise consider SFTP (SSH) for occassional remote access.

(Note that all relatively modern SMB software only needs TCP port 445. The only time you need 137-139 is if you're dealing with pre-Win2000 systems, and in that case you really should do it inside a VPN.)