Setting up file sharing between Linux and Windows means configuring Samba correctly. If your firewall blocks the right ports, clients can't connect. If you leave unnecessary ports open, you invite attacks.
Samba relies on specific network ports to handle authentication, file transfers, and name resolution. Knowing which ports matter, how to verify them, and how to restrict access protects your network without breaking file shares.
Understanding Samba Network Ports
Samba uses both TCP and UDP ports to communicate with clients. Modern versions rely primarily on TCP port 445, but older legacy setups still depend on NetBIOS ports.
- TCP 445: Used for direct TCP/IP SMB communication. This handles file sharing, printer sharing, and session communication on modern Windows and Linux clients.
- TCP 139: Used for SMB over NetBIOS session service. Older Windows versions and specific enterprise setups require this for backward compatibility.
- UDP 137: NetBIOS name service. Clients use this to resolve machine names on the local network.
- UDP 138: NetBIOS datagram service. Used for broadcast messaging and browsing lists in older workgroup environments.
Modern environments running SMBv2 or SMBv3 can disable NetBIOS entirely, relying solely on port 445. If your network only contains modern operating systems, blocking ports 137, 138, and 139 reduces your exposure to network scanning tools.
Checking Active Samba Ports on Linux
Before changing firewall or configuration files, verify which ports your Samba daemon (smbd) currently listens on. Run the following command in your terminal:
sudo ss -tulpn | grep smbd
This output displays the listening states for smbd and nmbd. You should see entries for port 445 and optionally port 139 if NetBIOS is active.
To check if a specific port is accessible from a remote client machine, use the nc (Netcat) utility:
nc -zv 192.168.1.50 445
If the port is open and your firewall permits traffic, the command returns a successful connection message immediately.
Configuring Samba to Bind to Specific Interfaces
By default, Samba listens on all available network interfaces. If your Linux server has multiple network cards or connects to both a private LAN and a public interface, you must restrict Samba to listen only on your internal network.
Open your main configuration file, located at /etc/samba/smb.conf, using a text editor with root privileges:
sudo nano /etc/samba/smb.conf
Inside the [global] section, add or modify the interfaces and bind interfaces only directives:
[global]
workgroup = WORKGROUP
security = user
interfaces = lo eth0 192.168.1.0/24
bind interfaces only = yes
This configuration ensures that even if port 445 is exposed on the firewall for a specific internal subnet, the Samba daemon itself refuses connections originating from unlisted network interfaces. Save the file and restart the Samba service:
sudo systemctl restart smbd nmbd
Configuring Firewalls for Samba Traffic
Linux firewalls block inbound traffic by default. You need to explicitly allow Samba traffic based on the firewall utility your distribution uses.
UFW (Ubuntu / Debian)
If you use Uncomplicated Firewall, you can allow Samba traffic using the built-in application profile:
sudo ufw allow Samba
Alternatively, open specific ports manually if you want to restrict NetBIOS:
sudo ufw allow 445/tcp
sudo ufw allow 139/tcp
sudo ufw reload
Firewalld (RHEL / CentOS / Fedora)
If your distribution uses Firewalld, enable the predefined Samba service rule:
sudo firewall-cmd --permanent --add-service=samba
sudo firewall-cmd --reload
To verify that your firewall rules are active, list the permitted services or ports:
sudo firewall-cmd --list-all
Common Configuration Mistakes
System administrators often run into connectivity issues due to subtle mistakes in network and Samba settings.
- Forgetting the NMB Daemon: Users often restart only
smbdwhile troubleshooting name resolution problems. If client machines cannot find the server by hostname, ensurenmbdis running and UDP ports 137 and 138 are open. - Incorrect Interface Binding: If you restrict
interfaces =insmb.confbut misspell the interface name or type an incorrect subnet mask, Samba will fail to bind to any port, dropping all client requests silently. - SELinux Restrictions: On Red Hat-based systems, SELinux can block Samba from writing to shared directories or binding to non-standard ports. Always check audit logs (
/var/log/audit/audit.log) if connections fail despite correct firewall and configuration rules. You can check the Red Hat Documentation for specific SELinux boolean flags related to Samba sharing.
Frequently Asked Questions
Can I change Samba from port 445 to a custom port?
Samba is hardcoded to listen on standard SMB ports by design, because Windows clients always attempt to connect to port 445. Changing the listening port on the server side requires configuring port forwarding or complex client-side mapping, which breaks standard file explorer browsing. It is best to keep standard ports and restrict access using firewall rules instead.
Why do I need port 139 if port 445 handles file sharing?
Port 139 handles NetBIOS over TCP/IP. You only need this port open if you have legacy clients running older software or embedded network devices that do not support direct TCP SMB (port 445). Modern Windows and Linux systems negotiate port 445 directly and ignore port 139 entirely.
How do I test if my Samba shares are reachable locally?
You can test local connectivity by mounting the share locally on the server itself before debugging network issues:
sudo mount -t cifs //127.0.0.1/myshare /mnt/test -o username=myuser
If this mount succeeds, your Samba daemon configuration is correct, meaning any connection failures are strictly related to network routing or firewall rules.
Is it safe to expose Samba port 445 to the public internet?
No. Exposing port 445 to the public internet is extremely dangerous. Attackers constantly scan for open SMB ports to launch ransomware and exploit unpatched vulnerabilities. Always keep Samba behind a secure local network, VPN, or private tunnel.
