Load Balancer端口配置疑问：443收流量后转445访问后端可行吗？

Great question! The short answer is yes, this configuration is technically feasible—but there are key caveats to keep in mind to make it work reliably and securely. Let’s break this down:

Core Reason It Works #

Load balancers (LBs) operate at the TCP (or lower) layer for basic port forwarding, regardless of the "default" protocol associated with a port. Mapping frontend port 443 to backend port 445 is just a matter of configuring the LB to route incoming TCP traffic on 443 to your backend servers' 445 ports. The protocol labels (HTTPS vs SMB) are just common conventions, not hard rules that restrict the LB’s ability to forward traffic.

Critical Considerations #

• Skip SSL Termination: If your LB is set up to terminate HTTPS (decrypt SSL traffic at the LB), this will break the SMB connection. SMB uses its own encryption (if enabled) or relies on unencrypted TCP, so you need to configure the LB for pure TCP passthrough (layer 4 forwarding) without modifying the traffic.
• Backend Server Prep: Ensure your backend servers have the SMB service running and listening on port 445. Update server firewalls/security groups to allow incoming traffic from the LB’s IP range on port 445.
• Client Alignment: This only works if your clients are sending SMB traffic over port 443, not standard HTTPS requests. For example, a web browser hitting your LB’s 443 port will send HTTP/HTTPS requests that the SMB service can’t process—leading to errors. Make sure clients use SMB tools targeting the LB’s 443 port.
• Security Hardening: SMB is a commonly targeted protocol for attacks. If this LB is exposed to the public internet:
  • Restrict incoming 443 traffic to trusted client IPs via LB rules
  • Enable SMB encryption on backend servers to protect traffic in transit
  • Consider pairing this with a VPN to limit exposure to authorized users only

Final Verdict #

As long as you configure the LB for TCP passthrough, get backend servers set up correctly, and ensure clients are using the right tools for SMB over 443, this port mapping works perfectly.

内容的提问来源于stack exchange，提问作者PraveenMathew