SMB alternative ports now supported in Windows Insider

Heya folks, Ned here again. Starting with Windows 11 Insider preview Build 25992 (Canary) and Windows Server Preview Build 25997the client now supports connecting to an server over TCP, QUIC, or RDMA using alternative ports. Today I'll explain configure this and talk about the near future of this in Windows and Insiders a bit.

Update: Windows Server Insider build 26040 now allows configuring alternative ports for over QUIC. See below for details.

Previous port behaviors

SMB server in Windows has required inbound connections using the IANA-registered port TCP/445 for decades, and the SMB TCP client has only supported connecting outbound to that TCP port. The newer SMB over QUIC protocol requires the QUIC-mandated UDP/443, both for server and client. Until now these were hard-coded and unalterable.

Configuring alternative ports

You can now connect to alternative TCP, QUIC, and RDMA ports with the SMB client as long as the SMB server supports listening on that port and has been configured to do so. You can do this through mapped drive commands NET USE or New-SmbMapping now, and in a coming release, specify ports to connect to on specific servers using Group Policy or PowerShell or through DNS SRV records. An administrator can also block the use of SMB client alterative ports completely using Group Policy.

Map an alternative port with NET USE

To map an alternative TCP port using NET USE, use the following syntax:

NET USE servershare /TCPPORT:
NET USE servershare /QUICPORT:
NET USE servershare /RDMAPORT:

For example, to map the G: drive port to TCP/847, use:

NET USE G: waukeganfs1.contoso.comshare /TCPPORT:847

Map an alternative port with New-SmbMapping

To map an alternative TCP port using New-SmbMapping PowerShell, use the following syntax:

New-SmbMapping -RemotePath servershare -TcpPort 
New-SmbMapping -RemotePath servershare -QuicPort
New-SmbMapping -RemotePath servershare -RdmaPort

For example, to map the G: drive port to TCP/847, use:

New-SmbMapping -LocalPath G -RemotePath waukeganfs1.contoso.comshare -TcpPort 847

 

Control use of SMB client alternative ports   

To control SMB client alternative port usage, configure the group policy under:

Computer Configuration Administrative Templates Lanman Workstation Enable Alternative Ports

gpeditgpedit 

Configuring SMB over QUIC alternative listening port

Insider does not support changing the SMB server TCP listening port to something besides the default 445. However, you can configure the SMB over QUIC server to use an alternative port, via the following powershell cmdlets:

Get-SmbServerAlternativePort
New-SmbServerAlternativePort
Remove-SmbServerAlternativePort
Set-SmbServerAlternativePort

The configure the SMB over QUIC listener to use a port other than its default UDP/443, use the New-SMBServerAlternativePort cmdlet. For example, to configure the port to UDP/1775, run the following on the Insider SMB over QUIC machine:

New-SmbServerAlternativePort -TransportType QUIC -port 1775 -EnableInstances Default

If you then run NETSTAT you'll see the server listening on that UDP port

NETSTAT -anob
...
UDP 0.0.0.0:1775 *:* 2848
LanmanServer

Final notes

Windows Server does not support configuring alternative SMB server TCP ports, but third parties such as Samba do. For more information on configuring non-standard SMB server ports in third parties, consult their product documentation.

This is part of a campaign to improve the security of Windows and Windows Server for the modern landscape. You've read my posts on SMB security changes over the past year:

For more information on securing SMB on Windows in-market, check out:

Until next time,

Ned Pyle

 

This article was originally published by Microsoft’s Server Storage at Microsoft Blog. You can find the original article here.