Amazon Linux Elastic Beanstalk部署Samba后Windows无法连接排查

Absolutely, Elastic Load Balancer (ELB) is almost certainly the culprit here—SMB and ELBs don’t play well together by default, and there are a few key reasons why your connection is failing. Let’s break this down and cover actionable fixes.

Key Issues with ELB and SMB #

• Protocol Mismatch: SMB is a stateful, multi-port protocol that relies on persistent connections. Classic and Application Load Balancers are optimized for stateless HTTP/HTTPS traffic, and their session handling doesn’t align with SMB’s requirements. Even Network Load Balancers (NLBs) need specific configuration to support SMB.
• Port Configuration Gaps: SMB uses ports 139 (NetBIOS) and 445 (direct SMB), plus dynamic ephemeral ports for data transfer. ELBs don’t automatically forward these ports—you need explicit listener rules, and dynamic ports are hard to manage since they aren’t fixed.
• Security Group Restrictions: Even if your EC2 instances allow SMB traffic, the ELB’s security group might not permit inbound connections on 139/445, or the instance security group might not allow traffic from the ELB.

Fixes to Get Your Samba Share Working #

1. Bypass the ELB Entirely (Simplest Solution) #

If your setup allows it, skip the ELB for SMB traffic:

• Assign an Elastic IP to your Elastic Beanstalk EC2 instance (note: Beanstalk replaces instances during deployments, so you’ll need to attach the Elastic IP to an instance profile or update your environment to use it consistently).
• Update your instance’s security group to allow inbound TCP traffic on ports 139 and 445 from your Windows server’s public IP.
• Test connecting directly to the Elastic IP from your Windows machine—this should work if your Samba configuration matches your working Ubuntu EC2.

2. Use a Network Load Balancer (NLB) with Static Port Setup #

If you must keep the ELB, switch to an NLB and configure it for SMB:

• Create an NLB with TCP listeners for ports 139 and 445, forwarding to the same ports on your Beanstalk instances.
• Restrict SMB to use a fixed range of ephemeral ports by editing your /etc/samba/smb.conf file:

  smb ports = 139 445
  socket options = TCP_NODELAY IPTOS_LOWDELAY SO_RCVBUF=131072 SO_SNDBUF=131072
  max protocol = SMB3
  

• Open the fixed ephemeral port range (check your OS defaults, or set a custom range like 49152-65535) in both the NLB security group and your EC2 instance security group.

3. Verify Security Group and Firewall Rules #

• Double-check that your Beanstalk instance’s security group allows inbound traffic on 139/445 from either the ELB’s security group (if using NLB) or your Windows server’s IP (if bypassing).
• Ensure the instance’s local firewall (iptables or firewalld) isn’t blocking SMB ports—run sudo iptables -L or sudo firewall-cmd --list-all to confirm.

4. Validate Direct Instance Connectivity #

To confirm the ELB is the issue, test connecting to your Beanstalk EC2 instance’s private IP from another EC2 in the same VPC (like your working Ubuntu server). If that connection succeeds, you know the problem lies with the ELB configuration rather than your Samba setup.

内容的提问来源于stack exchange，提问作者GeneralBear