Forcing SMB Over 445 Instead of 80

Question

A similar question had been asked here (Windows file explorer using port 80 (webdav) instead of 445 (samba smb cifs) for UNC path), however the solution did not work for my purposes.

I've recently set up an OpenVPN solution and am attempting to use it to connect to other computers. I got all that set up OK, but now I've been trying to connect via SMB to those computers.

When I attempt to connect via SMB (using net use, windows explorer, or whatever else) locally (192.168.x.x), Windows will use port 445 just fine. However, when I attempt to connect to the remote network (192.168.y.y), Windows decides it needs to use port 80 and 135. Naturally, 80 fails and 135 doesn't have the services I'm trying to use.

TCP/IP NetBIOS Helper service is running (and works just fine in the local subnet). When I disable the web client service (even though it's not running), Windows will just skip the port 80 attempts and go straight to port 135 for the remote network. I have similarly changed around the provider orders of preference in the network settings, but that hasn't changed anything.

How do I tell restrict Windows to use only port 445 for SMB? This seems to have something to do with it not being in the local subnet.

If it matters, the clients are using Windows 7 Pro x64.

Solution

Yes, it's possible.

Just for background (or FYI), port 135 is used for NETBIOS, which only functions within the local broadcast domain, unless there's a WINS server, which basically no one has any more. So that's why you're seeing different behavior based on what subnet you're in.

By default:

The following ports are associated with file sharing and server message block (SMB) communications:

• Microsoft file sharing SMB: User Datagram Protocol (UDP) ports from 135 through 139 and Transmission Control Protocol (TCP) ports from 135 through 139.
• Direct-hosted SMB traffic without a network basic input/output system (NetBIOS): port 445 (TCP and UPD).

In order to change this behavior, you basically need to disable NETBIOS over TCP/IP. This can be done on the machine's network adapter, or even by a Windows DHCP server, depending on your preference. It's Windows-land, this is referred to as "direct access SMB", and the Microsoft KB which outlines how to force direct access SMB is here.

(Yes, that KB is applicable to Windows 7 and Vista as well, even though they're not in the list of applicable OSes - Windows 7 and Vista, by default, get their NETBIOS over TCP/IP settings from a DHCP server, and I've yet to see one that I didn't set up which disables NETBIOS over TCP/IP.)

Comments

[natxo asenjo]

very informative answer. My only addition would be to specify that you can disable netbios using a dhcp server, period. You do not need a Windows dhcp server specifically to do that. I do it in my home network using dnsmasq for instance, and at work with isc dhcpd.

[fantadisco]

Thanks for the information! Unfortunately, the problem I'm having is that Windows is defaulting SMB connections when not in the local subnet to WebDAV (port 80) and then trying Windows RPC (135). Interestingly enough, 135 will indeed connect across sub-domains. One problem is that RPC will not allow file transfers. There are likely other things that 135 will not be able to do as well.