Home / ubuntu / Questions / 1233773
In Process
George
Asked: 2020-05-01 21:39:01 +0800 CST

UFW rules for Windows network share in 20.04

  • 772

I have always had a network share with my nas (Alt-F) setup in Ubuntu. To access it I allow port 137&138udp in and out and 139&445tcp in and out within ufw. Since upgrading to 20.04 those rules don't work anymore. I have to turn the firewall off to be able to see the share. Once it is mounted and the folder opened I can turn the firewall back on and it works as normal but to be able to see it on the network or open the main folder initially I have to turn off the firewall. Is there another port that now has to be opened in 20.04? The other strange thing is that if I turn SMB1 off on my NAS I can't see the share in Ubuntu, if I turn off SMB2 I can see it but I can't mount any shares, so both SMB1 and SMB2 both have to be activated so that I can see the share (SMB1) and mount it (SMB2). I have always had this working from versions 10-18.04 and in 20.04 is the first time I have had this issue.

samba ufw 20.04

1 Answers

  1. I have the same problem. It looks as though the network name is not being seen. A workaround that works for me is to create a connection using the shares numeric address such as smb://192.168.1.x/.... and bookmark it. Also, if a password is required, you could set that to "Remember forever".

    Edit:- Further investigation " Port 137. UDP NetBIOS name query packets are sent to this port, usually of Windows machines but also of any other system running Samba (SMB), to ask the receiving machine to disclose and return its current set of NetBIOS names.

    The following command shows that port 137 should be open

    sudo ufw status [sudo] password for ***: Status: active

    To Action From -- ------ ---- 137,138/udp ALLOW Anywhere
    139,445/tcp ALLOW Anywhere
    631 ALLOW Anywhere
    5353/udp ALLOW Anywhere
    5298 ALLOW Anywhere
    137,138/udp (v6) ALLOW Anywhere (v6)
    139,445/tcp (v6) ALLOW Anywhere (v6)
    631 (v6) ALLOW Anywhere (v6)
    5353/udp (v6) ALLOW Anywhere (v6)
    5298 (v6) ALLOW Anywhere (v6)

    tail -f /var/log/ufw.log

    Jun 10 10:13:43 Delta-Ubuntu kernel: [ 968.572307] [UFW BLOCK] IN=enp2s0 OUT= MAC=d0:27:88:04:b8:55:30:23:03:0e:6b:3c:08:00 SRC=192.168.1.1 DST=192.168.1.27 LEN=90 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=137 DPT=55794 LEN=70 Jun 10 10:13:44 Delta-Ubuntu kernel: [ 969.521720] [UFW BLOCK] IN=enp2s0 OUT= MAC=d0:27:88:04:b8:55:30:23:03:0e:6b:3c:08:00 SRC=192.168.1.1 DST=192.168.1.27 LEN=90 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=137 DPT=50676 LEN=70

    The above log extract shows SPT=137 being blocked by ufw which would explain why the NetBIOS names are not being seen. Go figure.

    "

    • 0