Configuring Linux Firewall with UFW for SMB
Secure Samba and SMB file sharing on Linux by allowing only the required traffic, limiting access to trusted local networks, and verifying your UFW firewall rules.
Make SMB access deliberate and network-scoped
For modern Windows and Linux file sharing, TCP port 445 is usually the key inbound port. A safer default is to permit it only from the local subnet or known client addresses that need access, rather than opening Samba to every source.
192.168.1.0/24 as an example LAN; replace it with your actual subnet before applying rules.Restrict the source
Allow SMB only from the LAN subnet or individual client IP addresses that require file access.
Prefer modern SMB
Start with TCP 445. Add legacy NetBIOS ports only when your environment actually needs them.
Verify before testing
Review UFW status and Samba service listeners, then test from an allowed client and a blocked source.
Introduction
Samba provides SMB/CIFS file and printer sharing between Linux, Windows, and other compatible systems. UFW (Uncomplicated Firewall) is a front end for managing host firewall rules on Ubuntu and many Ubuntu-based systems. Correct firewall rules can make a share reachable to approved devices while blocking unsolicited connections from other networks.
This tutorial focuses on the firewall layer. It does not create a Samba share, create Samba users, or change file-system permissions. Those controls must also be configured correctly; a firewall rule alone does not make a share secure.
Requirements and assumptions
- A Linux server with UFW installed (examples use Ubuntu Server/Debian-style commands).
- Samba is installed and configured if this machine is acting as an SMB file server.
- A sudo-capable administrator account and console or reliable SSH access.
- The actual server address and trusted client subnet are known.
- You have confirmed the server is not intended to provide SMB access directly from the public internet.
Example values used throughout this article:
| Setting | Example | Replace with |
|---|---|---|
| Server address | 192.168.1.20 | Your Linux server IP |
| Trusted LAN | 192.168.1.0/24 | Your real client subnet |
| SMB port | 445/tcp | Normally TCP 445 for modern SMB |
Step 1: Identify the Linux server IP and LAN subnet
Before writing a firewall rule, identify the active network interface and server addresses.
ip -br address
ip routeLook for the interface connected to your LAN and note its IPv4 address and prefix. For example, 192.168.1.20/24 typically belongs to 192.168.1.0/24. Do not assume the sample subnet matches your environment; verify the network plan or router configuration.
Step 2: Check UFW status and current rules
Inspect the firewall before changing it.
sudo ufw status verbose
sudo ufw status numbered
sudo ufw app listIf UFW reports inactive, rules can be added before enabling it. Review the existing policy and rules first so you do not accidentally remove required access. To see whether a Samba application profile is available, inspect it with:
sudo ufw app info SambaThe profile may allow multiple Samba-related ports, depending on the installed profile. For a tightly restricted modern SMB setup, an explicit TCP 445 rule limited to your subnet is often clearer than allowing a broad application profile globally.
Step 3: Confirm Samba is installed and listening
On an Ubuntu/Debian server, check whether the Samba server package is installed and whether the service is running.
dpkg -l samba
sudo systemctl status smbd --no-pager
sudo ss -lntup | grep -E ':(445|139)\b'If Samba is not installed and this machine is intended to host shares, install it using your distribution’s package manager and configure shares separately:
sudo apt update
sudo apt install sambaA firewall rule cannot make a service listen if Samba is stopped or configured for different interfaces. Also review /etc/samba/smb.conf and validate its syntax before restarting Samba:
testparm -sStep 4: Protect remote administration access
If you are connected over SSH, make sure your management connection remains permitted before enabling UFW. For a typical SSH server listening on the default port, you can allow SSH before turning on the firewall:
sudo ufw allow OpenSSHIf SSH uses a custom port or access should be limited to a management subnet, create the corresponding rule for that port and trusted source instead. Check the current SSH configuration and network path rather than blindly opening port 22 to every address.
Step 5: Allow SMB from the trusted subnet
For modern SMB, allow inbound TCP port 445 only from the network that should access the share. Replace the sample subnet with your verified LAN range.
sudo ufw allow from 192.168.1.0/24 to any port 445 proto tcpThis rule limits the source addresses allowed to connect to TCP 445. If only one device should access the share, use its fixed IP address instead of the whole subnet:
sudo ufw allow from 192.168.1.50 to any port 445 proto tcpFor a server with a stable address on a specific interface, you can make the destination more explicit using the server IP:
sudo ufw allow from 192.168.1.0/24 to 192.168.1.20 port 445 proto tcpChoose one rule style appropriate to your network and avoid adding redundant rules. UFW rules are evaluated alongside the rest of your host firewall configuration, so review the complete rule list afterward.
sudo ufw allow 445/tcp as a universal default on a server reachable from untrusted networks, because that can permit SMB from any source allowed by the surrounding firewall policy.Step 6: Add legacy NetBIOS ports only if required
Older Windows networks or legacy browsing workflows may require NetBIOS-related ports. Modern SMB file access typically does not require opening all of these ports. If you have confirmed that your environment needs them, restrict each rule to the trusted subnet.
# Legacy NetBIOS name service
sudo ufw allow from 192.168.1.0/24 to any port 137 proto udp
# Legacy NetBIOS datagram service
sudo ufw allow from 192.168.1.0/24 to any port 138 proto udp
# Legacy NetBIOS session service
sudo ufw allow from 192.168.1.0/24 to any port 139 proto tcpDo not add these rules merely because a generic Samba profile exists. Confirm your clients and network require legacy NetBIOS functionality. If they do not, leave the legacy ports closed.
Step 7: Enable and verify UFW
After reviewing all required management and application rules, enable UFW if it is not already active. The command may ask you to confirm the operation.
sudo ufw enable
sudo ufw status verbose
sudo ufw status numberedFor the modern SMB example, look for an allow rule for TCP 445 whose source is the intended subnet or host. Confirm that SSH or your alternate management path is still allowed if required. Use numbered status output to identify exact rules before deleting or changing them.
To remove a rule, first list the numbered rules and then delete the correct number, checking the list again because numbering can change:
sudo ufw status numbered
sudo ufw delete NUMBERReplace NUMBER with the actual rule number displayed by UFW. Do not paste the placeholder literally.
Step 8: Test SMB connectivity
From a client on the permitted LAN, test whether the server is reachable on TCP 445. On a Linux client with netcat installed:
nc -vz 192.168.1.20 445On Windows PowerShell, use:
Test-NetConnection 192.168.1.20 -Port 445Then try accessing a share with a suitable SMB client. From Linux, for example:
smbclient -L //192.168.1.20 -U your_samba_userReplace the IP and username with your actual values. A successful TCP test only proves the port is reachable; authentication, share permissions, DNS, and SMB client policy still affect whether a file share opens. Test from a host outside the allowed subnet, where feasible, to verify that access is restricted as intended.
Troubleshooting UFW and SMB
Client cannot connect to port 445
Check the server IP, route, UFW source subnet, Samba service status, and whether TCP 445 is listening. Confirm that another firewall or router ACL is not blocking traffic.
sudo ufw status verbose
sudo ss -lntp | grep ':445'Firewall rule uses the wrong subnet
Compare the client address and prefix with the source network in the UFW rule. A client on a guest Wi-Fi VLAN may not belong to the same subnet as the server.
ip -br address
ip routeTCP 445 works, but the share is denied
This is often an authentication, Samba share configuration, or file-system permission issue rather than a firewall problem. Review the share definition and Samba user credentials.
testparm -s
sudo systemctl status smbd --no-pagerWindows network browsing does not show the server
Network discovery and legacy browsing are separate from direct SMB connectivity. Try accessing the share by hostname or IP, and only open NetBIOS ports if your environment specifically requires them.
SSH stopped working after enabling UFW
Use a local or out-of-band console to inspect the rules. Add a narrowly scoped rule for your actual SSH port and management source, then retest before closing the console session.
sudo ufw status numberedA Samba application profile opens too much
Inspect the installed profile with sudo ufw app info Samba. If you only need modern SMB, replace a broad profile rule with a source-restricted TCP 445 rule after confirming no required service depends on the other ports.
Security best practices
- Never expose TCP 445 directly to the public internet; use a VPN or another secure remote-access design.
- Limit SMB rules to known client IP addresses or trusted internal subnets.
- Use strong Samba authentication and least-privilege share and filesystem permissions; avoid guest access unless there is a deliberate, controlled use case.
- Keep Samba, the Linux operating system, and Windows clients updated.
- Prefer modern SMB and disable legacy protocols and NetBIOS services when they are not needed.
- Review UFW rules after adding or removing services, network interfaces, or VLANs.
- Use logs and monitoring to investigate unexpected connection attempts; do not treat a firewall as a replacement for application security.
- Document approved source networks and validate rules after router or subnet changes.
SMB ports at a glance
| Port | Protocol | Purpose | Guidance |
|---|---|---|---|
| 445 | TCP | Direct-hosted SMB | Usually required; allow only trusted sources. |
| 137 | UDP | NetBIOS name service | Legacy; allow only if needed. |
| 138 | UDP | NetBIOS datagram service | Legacy; allow only if needed. |
| 139 | TCP | NetBIOS session service | Legacy; allow only if needed. |
Exact service requirements depend on the Samba configuration and client environment. The safest firewall policy is the smallest set of ports and source networks that meets the documented business requirement.
Frequently Asked Questions
Which UFW port should I open for SMB?
For modern direct-hosted SMB, TCP 445 is normally the key port. Restrict the rule to trusted clients or subnets. Legacy NetBIOS services may use UDP 137, UDP 138, and TCP 139 if required.
Can I simply run sudo ufw allow Samba?
UFW may provide a Samba application profile, but it can permit multiple ports and may not restrict the source network. Inspect it with sudo ufw app info Samba. For a tightly scoped modern SMB setup, an explicit source-restricted TCP 445 rule is often preferable.
Should I open port 445 on my router?
No. Do not port-forward SMB TCP 445 from the public internet. For remote access, use a properly secured VPN or another approved remote-access solution.
Does UFW configure Samba shares?
No. UFW manages host firewall rules. Samba still needs its own configuration, user authentication, share definitions, and filesystem permissions.
Why can I ping the server but not open the share?
Ping only tests ICMP reachability. SMB also depends on TCP 445, a listening Samba service, firewall rules, authentication, and share permissions.
How do I remove an overly broad SMB rule?
Run sudo ufw status numbered, identify the exact rule, and delete it with sudo ufw delete NUMBER. Confirm the numbering after each deletion and ensure the intended restricted rule remains.
Conclusion
Configuring UFW for SMB is straightforward when you identify the required ports and restrict access to the right network. For most modern Samba file servers, begin with TCP 445 and allow only the trusted LAN clients that need access. Add legacy NetBIOS ports only when there is a specific compatibility requirement.
Before finishing, verify the active firewall rules, confirm Samba is listening, test from an allowed client, and ensure the service is not reachable from untrusted networks. Combine host firewall rules with secure Samba configuration, authentication, and regular patching.
Continue Learning Linux on VMoreCloud
Explore practical Linux administration, networking, cybersecurity, cloud computing, virtualization, backup, and infrastructure tutorials.
Linux • Samba • Networking • Cybersecurity • Cloud • Virtualization
Sources & Further Reading
Technical note: UFW application profiles, Samba defaults, and network layouts vary by distribution and installation. Verify your installed profile and actual network ranges before applying rules. Commands are examples and should be reviewed in a test or maintenance window before use on production systems.