Samba Ports: 445, 139, 137 and 138 and How to Open Them Safely

Applies to: Samba 4.19 to 4.23 on AlmaLinux, Rocky Linux, Ubuntu and Debian (tested with Samba 4.23.5 on AlmaLinux 9 and 4.19.5 on Ubuntu 24.04)

Samba shares files and printers with Windows, macOS and Linux computers using the SMB protocol. With default settings it listens on four ports. We installed Samba 4.23.5 and checked with ss -tulpn:

• TCP 445: SMB directly over TCP. The port every current client uses.
• TCP 139: SMB over NetBIOS, for old clients.
• UDP 137: NetBIOS name service (nmbd).
• UDP 138: NetBIOS datagram service (nmbd).

sudo ss -tulpn | grep -E "smbd|nmbd"

Never open Samba to the whole internet

SMB is made for local networks. Port 445 exposed to the internet is scanned constantly and has a long history of serious attacks. To reach a share on a remote server, use a VPN, or allow only your own IP addresses.

Open the ports for your network only

firewalld (AlmaLinux, Rocky Linux) has a ready-made samba service. It opens TCP 139 and 445 and includes the NetBIOS services (UDP 137 and 138). Allow it for one network with a rich rule:

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" service name="samba" accept'
sudo firewall-cmd --reload

ufw (Ubuntu, Debian): the Samba package adds a ufw profile named Samba (137,138/udp and 139,445/tcp):

sudo ufw allow from 192.168.1.0/24 to any app Samba

Use only port 445 (turn off NetBIOS)

Modern clients don’t need NetBIOS. Add these lines to the [global] section of /etc/samba/smb.conf:

disable netbios = yes
smb ports = 445

testparm -s                      # check the configuration
sudo systemctl restart smb       # smbd on Ubuntu and Debian
sudo systemctl disable --now nmb # nmbd on Ubuntu and Debian

After this, our test servers listened on TCP 445 only. The same two lines worked on Samba 4.19 (Ubuntu 24.04) and 4.23 (AlmaLinux 9). In Samba 4.23, smb ports is a synonym for the new setting server smb transports (default tcp, nbt, meaning ports 445 and 139); Samba 4.19 doesn’t know the new name and ignores it, so use smb ports.

Check from a client

nc -zv 192.168.1.10 445                           # Linux or macOS
Test-NetConnection 192.168.1.10 -Port 445          # Windows PowerShell

Setting up shares: beginner’s guide to Samba, guest and home shares and add or delete a Samba user. Other port numbers: HTTPS, SSL and email ports.