Is port 445 enough for SMB?

I have a ssh tunnel from my Windows 10 machine to a Linux server (192.168.10.2 in a LAN, with port 22 exposed on the Internet and forwarded there) that also serves SMB.

I tried to forward my local 127.0.0.3:445 to that server and map \\127.0.0.3. This fails with "Windows cannot access \\127.0.0.3.

On the flip side, when I am in the network where 192.168.10.2 is, I have no problems mapping \\192.168.10.2.

This would suggests that in order to map a share I need more than just access to the port 445. Is that correct?

EDIT: as a side note, other ports going through that tunnel are fine (HTTPS, MQTT, ...)

1 Answer

Yes, modern SMB (especially v2/v3) runs only on TCP port 445. However, Windows clients may also expect the server to be pingable, i.e. respond to ICMP Echo, before they even attempt a SMB connection.

Also, it could be that Windows implicitly maps all local address to a magic loopback connection that bypasses the TCP/IP stack entirely and is therefore unaware of your SSH tunnel. I would definitely recommend an IP-level VPN instead.

_{Only very old clients, Windows 9x era and older, will expect TCP port 139 instead (and possibly the NetBIOS Datagram service on UDP 137-138).}

_{Recently, Microsoft has announced an experimental SMB-over-QUIC which can use UDP port 443 as alternative. This is not yet publicly available.}