cancel
Showing results for 
Search instead for 
Did you mean: 

Is it possible that Swisscom is blocking some ports?

Novice
1 of 13

I just switched my VDSL2 line from an old contract to Vivo XS.

 

I struggled to get everything back to work because I use a FRITZ!Box 7490 and somehow I needed to change the provider profile from "Swisscom" to "Swisscom All IP", but now everything is fine.

 

Well, apart from a problem I just realized: I cannot connect to my SMB/CIF server anymore from outside the local network. Some info:

 

- I can connect locally to SMB (localhost, 192.168.x.x, by hostname).

 

- I can connect remotely to other services on the same host (SSH, HTTP, HTTPS).

 

- Of course, port 445 is forwarded (and I tried to forward also 137-139, just in case, although I am pretty sure that it is not needed for me). Besides, everything was working fine until before the Swisscom switch. And I even tried to put the host completely exposed to no avail.

 

 

- I cannot connect remotely to SMB (error NT_STATUS_UNSUCCESSFUL from smbclient).

 

Is it possible that Swisscom has decided to block port 445?!

 

p.

12 Comments
Super User
2 of 13
Nope. But SMB is not the ideal protocol for wan
Novice
3 of 13

Thanks.

 

(1) Very precise answer, but how can you tell? I may most certainly be wrong, but there are few other plausible explanations I can think of at this time (the router is now broken and now fails to honour the 445 forward, and only that one, and this peculiar fault appeared exactly in the last few days?). Do you know of a way (besides the online port checks of the style http://www.yougetsignal.com/tools/open-ports/, which of course fails for 445 but not, say for 22) to prove that Swisscom lets 445 pass? This would help a lot.

 

(2) SMB has worked quite fine for me over the years. True, I do not have very complex needs. What else would you suggest?

 

p.

Super User
4 of 13

1) sorry, not very precise. I really suppose that swisscom doesn't block that CIFS Port.

Just let a port scan running under that port. I assume that port forwaring has been setup correctly?

 

https://www.heise.de/security/dienste/portscan/test/go.shtml?scanart=1

 

2) I'm not a networking expert but http (even if an old protocoll) could be use for that kind of data transfer

Novice
5 of 13

A small concise update: I *really* have no idea what is the cause of the problem.

 

The long story: (1) Yes, forwarding is correctly set, as far as I can tell. I tried also with exposing the host completely (an option in FRITZ!Box) and nothing changes, so I tend to assume forwarding works. All tools on the internet checking if a port is open tell that 445 is closed, but I believe they cannot distinguish whether the ISP closed it, the router did not forward it, or the service on the destination host is broken. In other words, I do not think they help much debugging. (2) I believe the SMB/CIFS server works fine, for I can connect from the home network both by host name and by internal IP without any difficulty. Besides, it has always worked from the internet for years before the change in the Swisscom contract (but I do not use it very often, so I cannot correlate with certainty the two events). (3) I have another server at home with some open SMB/CIFS shares. It has a completely different and much more recent version of Linux and Samba and, in some respects, I think its configuration is much more straightforward (read: there is less likelyhood of stupid sneaky errors on my side). I have opened 445 and the other SMB/CIFS ports in the router toward that newer host and the behaviour is *exactly* the same. (4) This would seem enough for me to blame Swisscom, but for one experiment: I tried the undocumented FRITZ!Box feature to capture all packets before and after the router and used Wireshark to look at the traffic. Let me say upfront that I am too ignorant to really know what is happening but the exchanges to the SMB/CIFS host from a local host and from a remote host (via internet) look quite different and, even at the packet level, it is clear that the former succeed while the latter exchange somehow get screwed. Again, I do not understand enough to tell what is going on, but what puzzled me is that I see coming from Internet some packets to port 445 and, of course, they are correctly forwarded. Unfortunately, they do not seem the same that come (while performing the very same operations) from the local host. One wild theory that I have is that Swisscom does sends through some 445 packets but corrupted in some way or replaced with some other stuff. Is this possible? Or is anything else failing? I have no idea.

 

The conclusion: due to the problem, I read a bit around about the SMB/CIFS security concerns and, although I really have nothing much confidential or valuable on the share, I decided that it is still a better idea to rely on SFTP and forget SMB/CIFS on the internet. I find it marginally less comfortable, but....

 

But, for the record, I am not sure that Swisscom treats packets to port 445 transparently as it should. Something iffy on their side remains the most plausible explanation of the problem in my mind.

Novice
6 of 13

Just an observation...

 

For some reason Swisscom's routers seem to have a problem with NAT port forwarding when a manual IP addrss is assigned.  I keep forgetting this and have to go through a few hours of nerving troubleshooting every few years until I realize using DHCP allows NAT to work properly.  

 

 

Novice
7 of 13

One of the PCs I used is indeed assigned a fixed IP address in the local network but the other is assigned by DHCP, and both fail. But I am using a FRITZ!Box 7490, not the Centro Grande.

 

Thanks, though.

 

p.

Novice
8 of 13
One other thing that might help is disabling upnp. I'm not sure if it's a solution but it's one thing I try when things aren't working.

Novice
9 of 13

Thanks. Not sure how to do that exactly, but I will try it.

Highlighted
Novice
10 of 13
On the Centro Grande there's a "UPnP" tab under Settings.
Novice
11 of 13

I can confirm they block it. Had to use an other port, I don't care I don't use SMB it's just for remote admin.

Expert
12 of 13

If you mean Swisscom blocks access to port 445, that's not what I can see.

Port 445 is open and I can connect without any Problem to my Server from anywhere.

 

Novice
13 of 13

At least with an Internet Box standart, from the DMZ, port 445 in not usable...