17

The firewall on my network drops all packets on TCP port 139 and 445. So all samba shares don't work outside the LAN.

I tried letting the samba daemon listen on a non-standard port. This method works well for linux, because both smbclient and smbmount has an option to set server port. But on windows I cannot find a similar option.

Does Windows support mounting smb shares on non-standard ports? Third-party softwares are also acceptable.

Edit:

\\hostname:port\share in Windows explorer doesn't work. Strangely, I can see the connection is established on the server. But Windows keeps telling me that the server couldn't be reached. It doesn't work even in LAN with standard port 445, in which case a path without port number will get through.

hpsMouse
  • 341

4 Answers4

7

This is possible! It's been a good few years, but combining a loopback interface tutorial I found with portions out of @Mike's [..link-only] answer (multihost version) I've created a script that can do this for you.

You can use this after running Install-Module -Name LoopbackAdapter -MinimumVersion 1.2.0.0 in an admin terminal (dont forget to dot-source the script so you can call this).

Create-Host -Name bob -Ip 10.254.0.1 -Dest ipOfHostname -Port port

which [upon reboot] will allow you to go to \\bob (fake IP 10.254.0.1) which attaches to your "hostname:port" from your question.
This will persist across boots and you don't need to re-run it if the source server goes up or down; teardown is as simple as Retire-Host -Name bob.

That easy, one command, programmatic, no gui/windows settings dialogs; but feel free to follow along below manually.

Explanation:

Use netsh portproxy to link a fake IP with your SMB server, this will make the nonstandard port accessible on one Explorer accepts.

#it's important IP's are used here, not hostnames
netsh `
    interface portproxy `
    add       v4tov4 `
    listenaddress=<#fakeIP#> `
    listenport=445 `
    connectaddress=<#serverIP#> `
    connectport=<#serverPort#>

Optionally add the IP to your %windir%\System32\drivers\etc\hosts file so you don't need to remember this IP (Eg interact with \\bob instead of \\10.254.0.1).

Use DevCon to create a loopback network adapter, this "network" is what will host the IP.

$interface = New-LoopbackAdapter -Name <#NAME#>

Disable conflicting/unused services that break various things.

$interface `
| Disable-NetAdapterBinding `
    -ComponentID ms_msclient,ms_pacer,ms_server,ms_lltdio,ms_rspndr

$interface | Set-DnsClient
    -RegisterThisConnectionsAddress $False -PassThru
| Set-NetIPInterface -InterfaceMetric '254'
    -WeakHostSend    Enabled -WeakHostReceive Enabled
    -Dhcp Disabled

Set the IP your machine will be reachable at on this "network".

$interface `
| New-NetIPAddress `
    -IPAddress     <#fakeIP#> `
    -PrefixLength  32 `
    -AddressFamily IPv4

Done! Upon reboot the forwarding will have hooked up, and you can access it as long as your pc can access the remote port. The setup will not disappear until you manually tear it down.

It's worth noting I only forward to 445 (and actually from 445 using ssh -L tunnelling to a machine on a network my pc cannot directly see), but it will simply be a change/additional netsh portproxy to swap/add the 139 equivalent if wanted.

To troubleshoot you can check windows is attempting to forward using

netsh interface portproxy show v4tov4

whether that is successfully listening on the loopback device

netstat -an | sls ':445'

and if your remote machine's server is accepting connections

Test-NetConnection -ComputerName <#serverIP#> -Port <#serverPort#>

finally that the whole thing has come together (and maybe it's some credential issue)

Test-NetConnection -ComputerName <#fakeIP#> -Port 445
Hashbrown
  • 3,338
  • 4
  • 39
  • 51
2

Unfortunately, it is not possible as windows does only support ports 445 and 139

You might be able to use ssh tunneling. Here is a reference using windows and linux: https://www.ocf.berkeley.edu/~xuanluo/sshproxywin.html

justsomeguy
  • 363
2

For those who are still looking for a way to mount SMB resources on a non-standard port, here is a great article on how to do this. I personally set up stunnel to wrap SMB traffic with SSL, since I access my SMB shares remotely over the Internet. Works like a charm.

Mike
  • 121
0

If third-party tools are OK and you only need to access a SMB share and not really mount it to an drive letter, the tool Owlfiles does the job. Here you can enter a different port number for accessing SMB shares.

I started to use it when tunneling SMB through SSH so I do not need to setup a loopback adapter.

The tool is available through MS store and the feature is available in the free version of this tool.

Peregrino69
  • 5,004
JMichael
  • 1