If I want to allow Windows networked drives between two firewalled computers, do I need to open ports 137-139, or is port 445 sufficient? I have to submit a form and get approval to open firewall ports, and I don't want to ask for more open ports than I need. All of the machines here are Windows XP or later.

Note: when I say "Windows networked drives", I'm not entirely sure whether I'm referring to SMB or CIFS, and I'm not entirely clear on the difference between the two protocols.

2 Answers 2


Ports 137-139 are for NetBios/Name resolution. Without it you will have to access machines by IP address opposed to NetBIOS name. Example \\\share_name opposed to \\my_file_server\share_name

So port 445 is sufficient if you can work with IP addresses only.

  • At my site, NetBIOS names are always the same as DNS names. So if I refer to machines by hostname, will Windows be able find the machine through DNS without using NetBIOS?
    – Jonathan
    Jan 3, 2012 at 17:28
  • 6
    As long as you have functioning DNS available to the client it should suffice.
    – Tim
    Jan 3, 2012 at 18:45
  • 1
    does this also work with public IP addresses? Is it enough to open port 445 in the firewall of the ADSL modem/router?
    – Hrqls
    Feb 18, 2015 at 9:33
  • 11
    @Hrqls In theory, yes, but AFAIK opening up your SMB to the whole world is a very bad idea. Aug 16, 2016 at 7:49
  • @Styne666 , totally agree. Even more: opening anything, which does not have adequate security support, to the whole Internet is generally bad idea. I would recommend to use IPsec transport mode to protect it at least.
    – dess
    Sep 29, 2019 at 21:21

This configuration worked for me: 137/UDP, 138/UDP, 139/TCP and 445/TCP. Source and additional information at: http://www.icir.org/gregor/tools/ms-smb-protocols.html.

So these are the iptables rules for my Samba server:

# The router doesn't need SMB access.
-A INPUT -s -p udp --dport 137 -j REJECT
-A INPUT -s -p udp --dport 138 -j REJECT
-A INPUT -s -p tcp --dport 139 -j REJECT
-A INPUT -s -p tcp --dport 445 -j REJECT

# Actual Samba ports
-A INPUT -s -m state --state NEW -p udp --dport 137 -j ACCEPT
-A INPUT -s -m state --state NEW -p udp --dport 138 -j ACCEPT
-A INPUT -s -m state --state NEW -p tcp --dport 139 -j ACCEPT
-A INPUT -s -m state --state NEW -p tcp --dport 445 -j ACCEPT
  • 5
    Given that the OP asked about Windows computers and their level of understanding of iptables is completely unknown, this would be better written out than as a completely different system's configuration file.
    – DarkMoon
    Oct 14, 2016 at 2:30
  • 2
    In plain English, UDP 137 and 138, TCP 139 and 445 Mar 21, 2019 at 2:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.