Sometimes we need to share resources from the server, such as a shared directory. Following some changes to our platform, it is now possible to map network drives using the public IP. This tutorial can be followed on Windows 2003, 2008, 2012, 2016 and 10.
WARNING!
Sharing directories over SMB in Windows can be very dangerous because it has many vulnerabilities. At Clouding we always recommend using this protocol over a VPN with the server's private IP. If you want to use the public IP, it is important to restrict access to this port to a single IP (as explained below).
Configure the server Firewall
The first thing we need to do is modify the Firewall on the server and add the following rules to open the ports. If you do not know how to add a new rule, we recommend visiting this article, where we explain how to manage rules in a firewall profile.
- Port 135 [TCP]
- Use: Communication for remote procedures and distributed components in Windows (DCOM and RPC).
- Risks: Vulnerable to exploits and attacks that take advantage of flaws in RPC services.
- Port 139 [TCP]
- Use: File and printer sharing on local networks through NetBIOS.
- Risks: Exposed to unauthorized access and attacks related to resource sharing.
- Port 445 [TCP]
- Use: SMB protocol for accessing files and printers on Windows networks.
- Risks: Targeted by ransomware and exploits of SMB vulnerabilities.
- Port 137 [UDP]
- Use: NetBIOS name resolution on local networks.
- Risks: Used for NetBIOS name enumeration and gathering information about the network.
- Port 138 [UDP]
- Use: Transmission of messages and notifications on NetBIOS networks.
- Risks: Vulnerable to information-gathering attacks and potential denial-of-service attacks.
When creating the rules, it is important never to enter 0.0.0.0/0, as this means everyone will have access to those ports. We therefore strongly recommend adding the rule with your IP. If you need several IPs to access those ports, you will need to add those ports for every IP that requires access.
Share a directory in Windows
Create a directory in Windows. Then right-click the directory and select Propiedades.
In the Propiedades window, go to the Compartir tab and click the button labeled Compartir...
Here, add the users you want to have access to your shared folder:
Once you have configured the users and their permission levels, click Compartir. A message will then appear showing the path to the shared folder. In our example, the path would be \\WINDOWS-ISS-SER\Users\administrator\Desktop\Carpeta_Compartida_SMB:
Map a network drive
Now, from Windows File Explorer, we can try accessing a shared network folder over SMB (Server Message Block), using the path (in this case, the following \\IP-interna\Users\administrator\Desktop\Carpeta_Compartida_SMB):
If it responds and we can see its contents, it is enabled for external connections:
Once the shared directory is enabled on the server, we will map a network drive from the client server.
To do this, open File Explorer and click "Este equipo".
When you click "Este equipo", the icons at the top will change. Select the "Conectar a unidad de red" option.
Now click Conectar a unidad de red and enter the following in the Carpeta field:
\\IP_de_nuestra_maquina\ruta_directorio\compartido
After entering the username and password, you will have access to your shared folders.
We hope this tutorial has helped you 🙂. Remember, if you have any questions about this or anything else related to your servers at Clouding, feel free to write to soporte@clouding.io We're here for you whenever you need us!