2

I have done a bit of port-forwarding before with success, but suddenly I encountered this problem that I do not know how to solve. I am hosting a samba share on port 137-139 and 445, and accessing the device via its local IP address (192.168.x.x) address works fine -- I can view the shares.

However, when I port-forward the correct ports in my router from the correct local IP address and access it via my public IP address, it works fine; but when anyone else tries to, the ports look closed. No online port scanner, nor friends I have contacted can connect to the share or see the open ports, even when using the exact same commands as me and my public IP. I am guessing my router supports hair-pinning since I can access my public IP at all times, but why would it behave differently for me compared to anyone else when using my public IP address?

My router model is ASUS RT-AC85P and I am hosting the share on a Raspberry Pi 3 Model B+. I have been able to port-forward before, so it is not a problem with my ISP, rather my router since I relatively recently changed it.

1

1 Answer 1

2

why would it behave differently for me compared to anyone else when using my public IP adress?

It could be that the RPi has IP-based firewall rules, as suggested in comments, but I suspect that it's your ISP blocking the connection – many ISPs block ports 137-139 and 445 specifically, even if they don't block anything else. (The Windows built-in SMB service was a major attack target several times, so they don't want to take the chances.)

When you're accessing your own public IP address, you're just talking directly to the router and not going through the ISP's connection. (Which is part of the reason why routers need specific support for hairpinning.) On the other hand, when you're connecting from the outside, then ISP filtering applies and the packets aren't even reaching the router in the first place, so your port-forward rules can do nothing about it.

If you need to access the server remotely (and if it must be over SMB), set up a VPN into your home network. Otherwise consider SFTP (SSH) for occassional remote access.

(Note that all relatively modern SMB software only needs TCP port 445. The only time you need 137-139 is if you're dealing with pre-Win2000 systems, and in that case you really should do it inside a VPN.)

2
  • Thank you so much! I tried opening a different port on the router and sure enough, it showed up! Too bad ISP's don't really have a good way to communicate what the problem is, or even inform of what they are blocking.
    – Blupper
    Jan 1, 2021 at 17:20
  • There is actually an ICMP error message specifically to indicate blocking... but nobody uses it, everybody just sets their firewalls to 'disintegrate'.
    – user1686
    Jan 7, 2021 at 19:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.