The Wiert Corner – irregular stream of stuff

Jeroen W. Pluimers on .NET, C#, Delphi, databases, and personal interests

  • My badges

  • Twitter Updates

  • My Flickr Stream

  • Pages

  • All categories

  • Enter your email address to subscribe to this blog and receive notifications of new posts by email.

    Join 2,519 other followers

Windows: unblocking SMB/NetBIOS/CIFS/File-and-Printer-sharing traffic from other subnets

Posted by jpluimers on 2021/10/29

If you enable File and Printer sharing on Windows, by default the firewall only enables it on private networks for the local subnet as remote address (for domain networks, it allows “Any”) as seen on the picture below.

When your network consists of multiple subnets, for instance when it is large, or multiple sites are connected via site-to-site VPN (often called LAN-to-LAN VPN) solutions, then these subnets cannot access each others files or printers.

Realising these default blocks, they are easy to resolve as explained in for instance [WayBack] Windows firewall blocking network shares through VPN server – Server Fault by [WayBack] Brian:

I realize this is almost three years late, but I just spent today fighting with the same problem. I did get it working, so I figured I’d share. Note that I’m using a Windows 7 PC as the file server; other versions might need slightly different configuration.

In the “Windows Firewall with Advance Security”, there are several “File and Printer Sharing” rules:

  • File and Printer Sharing (NB-Datagram-In)
  • File and Printer Sharing (NB-Name-In)
  • File and Printer Sharing (NB-Session-In)
  • File and Printer Sharing (SMB-In)

(There are additional rules, but I didn’t care about printer sharing. The same changes would apply if you want those.)

File and Printer Sharing appears to default to “Local subnet” only. You’ll need to add the subnet of your VPN clients.

Modify each of those rules as follows:

  1. Open the Properties dialog for the rule.
  2. Navigate to the Scope tab.
  3. In the Remote IP address section, the “These IP addresses” radio button should be selected.
  4. Click “Add…” next to the list of addresses. By default, only “Local subnet” is in the list.
  5. In the “This IP address or subnet:” field, enter the subnet assigned to your VPN clients (this is probably 192.168.1.0/24 in the OP, but if not, it’s the subnet assigned to the VPN adapter on the client side), then click OK.
  6. If you’re also using IPv6, add the VPN client IPv6 subnet as well.

That was enough for me to access file shares over the VPN.

(If you want to do it manually, you need to open TCP ports 139 and 445, and UDP ports 137 and 138, in the file server’s firewall.)

Hopefully I will find some time in the future to automate this using PowerShell, as netsh names are localised do hard to make universal.

These links might help me with that:

Routing NetBIOS traffic

Routing NetBIOS traffic can be tricky, especially name resolution.

That’s why many just use IPv4 addresses without names.

If you want to get it to work, these links might help:

–jeroen

Much longer list of all file and Printer  Sharing network addresses on a default Windows installation; one day I might research that into making a nice tabular lay-out:

PS C:\bin\> Get-NetFirewallRule –DisplayGroup "File and Printer Sharing" | ForEach-Object { Write-Host $_.DisplayName ; Get-NetFirewallAddressFilter -AssociatedNetFirewallRule $_ }
File and Printer Sharing (NB-Session-In)


LocalAddress  : Any
RemoteAddress : Any

File and Printer Sharing (NB-Session-Out)
LocalAddress  : Any
RemoteAddress : Any

File and Printer Sharing (SMB-In)
LocalAddress  : Any
RemoteAddress : Any

File and Printer Sharing (SMB-Out)
LocalAddress  : Any
RemoteAddress : Any

File and Printer Sharing (NB-Name-In)
LocalAddress  : Any
RemoteAddress : Any

File and Printer Sharing (NB-Name-Out)
LocalAddress  : Any
RemoteAddress : Any

File and Printer Sharing (NB-Datagram-In)
LocalAddress  : Any
RemoteAddress : Any

File and Printer Sharing (NB-Datagram-Out)
LocalAddress  : Any
RemoteAddress : Any

File and Printer Sharing (Spooler Service - RPC)
LocalAddress  : Any
RemoteAddress : Any

File and Printer Sharing (Spooler Service - RPC-EPMAP)
LocalAddress  : Any
RemoteAddress : Any

File and Printer Sharing (Echo Request - ICMPv4-In)
LocalAddress  : Any
RemoteAddress : Any

File and Printer Sharing (Echo Request - ICMPv4-Out)
LocalAddress  : Any
RemoteAddress : Any

File and Printer Sharing (Echo Request - ICMPv6-In)
LocalAddress  : Any
RemoteAddress : Any

File and Printer Sharing (Echo Request - ICMPv6-Out)
LocalAddress  : Any
RemoteAddress : Any

File and Printer Sharing (NB-Session-In)
LocalAddress  : Any
RemoteAddress : LocalSubnet

File and Printer Sharing (NB-Session-Out)
LocalAddress  : Any
RemoteAddress : LocalSubnet

File and Printer Sharing (SMB-In)
LocalAddress  : Any
RemoteAddress : LocalSubnet

File and Printer Sharing (SMB-Out)
LocalAddress  : Any
RemoteAddress : LocalSubnet

File and Printer Sharing (NB-Name-In)
LocalAddress  : Any
RemoteAddress : LocalSubnet

File and Printer Sharing (NB-Name-Out)
LocalAddress  : Any
RemoteAddress : LocalSubnet

File and Printer Sharing (NB-Datagram-In)
LocalAddress  : Any
RemoteAddress : LocalSubnet

File and Printer Sharing (NB-Datagram-Out)
LocalAddress  : Any
RemoteAddress : LocalSubnet

File and Printer Sharing (Spooler Service - RPC)
LocalAddress  : Any
RemoteAddress : LocalSubnet

File and Printer Sharing (Spooler Service - RPC-EPMAP)
LocalAddress  : Any
RemoteAddress : LocalSubnet

File and Printer Sharing (Echo Request - ICMPv4-In)
LocalAddress  : Any
RemoteAddress : LocalSubnet4

File and Printer Sharing (Echo Request - ICMPv4-Out)
LocalAddress  : Any
RemoteAddress : LocalSubnet4

File and Printer Sharing (Echo Request - ICMPv6-In)
LocalAddress  : Any
RemoteAddress : LocalSubnet6

File and Printer Sharing (Echo Request - ICMPv6-Out)
LocalAddress  : Any
RemoteAddress : LocalSubnet6

File and Printer Sharing (LLMNR-UDP-In)
LocalAddress  : Any
RemoteAddress : LocalSubnet

File and Printer Sharing (LLMNR-UDP-Out)
LocalAddress  : Any
RemoteAddress : LocalSubnet

File and Printer Sharing (LLMNR-UDP-Out)
LocalAddress  : Any
RemoteAddress : LocalSubnet

File and Printer Sharing (LLMNR-UDP-In)
LocalAddress  : Any
RemoteAddress : LocalSubnet

File and Printer Sharing (Echo Request - ICMPv6-Out)
LocalAddress  : Any
RemoteAddress : LocalSubnet6

File and Printer Sharing (Echo Request - ICMPv6-In)
LocalAddress  : Any
RemoteAddress : LocalSubnet6

File and Printer Sharing (Echo Request - ICMPv4-Out)
LocalAddress  : Any
RemoteAddress : LocalSubnet4

File and Printer Sharing (Echo Request - ICMPv4-In)
LocalAddress  : Any
RemoteAddress : LocalSubnet4

File and Printer Sharing (Spooler Service - RPC-EPMAP)
LocalAddress  : Any
RemoteAddress : LocalSubnet

File and Printer Sharing (Spooler Service - RPC)
LocalAddress  : Any
RemoteAddress : LocalSubnet

File and Printer Sharing (NB-Datagram-Out)
LocalAddress  : Any
RemoteAddress : LocalSubnet

File and Printer Sharing (NB-Datagram-In)
LocalAddress  : Any
RemoteAddress : LocalSubnet

File and Printer Sharing (NB-Name-Out)
LocalAddress  : Any
RemoteAddress : LocalSubnet

File and Printer Sharing (NB-Name-In)
LocalAddress  : Any
RemoteAddress : LocalSubnet

File and Printer Sharing (SMB-Out)
LocalAddress  : Any
RemoteAddress : LocalSubnet

File and Printer Sharing (SMB-In)
LocalAddress  : Any
RemoteAddress : LocalSubnet

File and Printer Sharing (NB-Session-Out)
LocalAddress  : Any
RemoteAddress : LocalSubnet

File and Printer Sharing (NB-Session-In)
LocalAddress  : Any
RemoteAddress : LocalSubnet

File and Printer Sharing (LLMNR-UDP-Out)
LocalAddress  : Any
RemoteAddress : LocalSubnet

File and Printer Sharing (LLMNR-UDP-In)
LocalAddress  : Any
RemoteAddress : LocalSubnet

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.

 
%d bloggers like this: