Samba File Sharing on OpenWrt: Configuration, Firewall, and Troubleshooting

Samba on OpenWrt is useful when I want to share a mounted HDD, SSD, or flash drive with Windows, Linux, or macOS clients on the LAN. OpenWrt also offers ksmbd, a lower-resource SMBv3 kernel server with fewer features; this article follows the official luci-app-samba4 path.[26]

Prerequisites

The USB/eSATA drive must already have its driver, filesystem, and mount point. A common package set is:[26]

1
2
3

USB drivers: kmod-usb3 kmod-usb-storage-uas usbutils block-mount mount-utils
Filesystems: kmod-fs-ext4 e2fsprogs kmod-fs-exfat exfat-fsck kmod-fs-ntfs3
Drive idle: luci-app-hd-idle

In LuCI, mount the drive under System → Mount Points, enable the entry, click Save & Apply, and use Generate Config if needed. Record the mount point, for example /dev/sda1 becoming /mnt/sda1. The source recommends at least 128 MB RAM; lower-memory machines may need another 128–256 MB of swap.[26]

Install and create a basic share

1. Install luci-app-samba4; dependencies such as samba4-server are installed automatically.[26]
2. Open Services → Network Shares in LuCI.[26]
3. Start with these values:[26]

Click Save and Apply. A correctly configured share can then be read and written from the LAN; Windows, for example, can open \\192.168.1.1\\storage\\. I do not expose Samba to the Internet just for convenience.[26]

Use user accounts instead of guest access

When guest access is not appropriate:[26]

1. Add a user entry to /etc/passwd and /etc/group.[26]
2. Choose a UID/GID of at least 1000 to avoid reserved values.[26]
3. Set a Samba password interactively with smbpasswd -a username; do not put the password in an article or repository.[26]
4. Add the account to LuCI → Network Shares → Allowed users, then Save & Apply.[26]

Safe illustrative entries are:[26]

1
2
3
4
5

# /etc/passwd
foo:x:1001:1001:smb user:/dev/null:/bin/false

# /etc/group
foo:x:1001:foo

Use chown and chmod for the required filesystem access. Unknown authentication names may be silently mapped to guest by default, so I check both filesystem permissions and Samba access rules.[26]

Advanced configuration outside UCI

After changing configuration files, restart Samba so /etc/samba/smb.conf is regenerated:[26]

1

service samba4 restart

LuCI/UCI builds the result from /etc/config/samba and /etc/samba/smb.conf.template. If I genuinely need to manage smb.conf beyond UCI:[26]

1

service samba4 disable

Add this to /etc/rc.local:[26]

1
2

smbd -D
nmbd -D

This makes startup and configuration my responsibility; later UCI changes can overwrite the file on boot.[26]

Apple Time Machine share

In Services → Network Shares, create a dedicated share with these important choices:[26]

• Interface lan, Workgroup WORKGROUP.[26]
• Disable Enable Extra Tuning and Force synchronous I/o.[26]
• Enable Enable macOS compatible shares.[26]
• Disable Allow legacy (insecure) protocols/authentication; leave Disable netbios unchecked.[26]
• Shared directory: a name, a path such as /mnt/sda1, Browseable enabled, Read-only disabled.[26]
• Use Force Root only on a secure LAN; prefer a dedicated account.[26]
• Define Allow users and disable Allow guests.[26]
• Create Mask 0600, Directory Mask 0700, Vfs objects disabled.[26]
• Enable Apple Time-machine share; the GB limit may be blank or set.[26]

The source says to disable Enable Extra Tuning for current macOS versions and that an extra avahi service is not needed on OpenWrt.[26]

Check access and startup

If a share will not open, inspect /etc/samba/smb.conf.template, the filesystem driver, and the mount point. As a diagnostic, the source suggests changing security from user to share, restarting the daemons, and trying:[26]

• Windows Explorer: \\router_ip[26]
• Nautilus/Dolphin: press <CTRL>+<L> and enter smb://router_ip/[26]

After installation, confirm the service under LuCI → System → Startup. From the command line:[26]

1
2

service samba4 enable
service samba4 start

If Windows does not show the share in Network, install wsdd2.[26]

Cannot write to a share

First check directory permissions and the account. The source lists this test, but 777 grants broad access, so I use it only for diagnosis on a trusted LAN and then narrow the permissions:[26]

1
2

chmod -R 777 /mnt/sda1
chown -R nobody /mnt/sda1

For an fstab mount, inspect the options, for example:[26]

1
2
3
4
5
6
7

config 'mount'
        option 'options' 'rw,umask=000'
        option 'enabled_fsck' '0'
        option 'enabled' '1'
        option 'device' '/dev/scsi/host0/bus0/target0/lun0/part1'
        option 'target' '/mnt/usbdisk'
        option 'fstype' 'vfat'

I do not keep umask=000 on a network with untrusted clients.[26]

International characters and LAN firewall

If names containing accented characters cannot be read or written:[26]

1

sed -i -e "/unix charset/s/ISO-8859-1/UTF-8/" /etc/samba/smb.conf.template

Restart Samba afterwards. With slow NAT paths, the documentation includes a LAN conntrack bypass for SMB ports:[26]

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

uci -q delete firewall.samba_nsds_nt
uci set firewall.samba_nsds_nt="rule"
uci set firewall.samba_nsds_nt.name="NoTrack-Samba/NS/DS"
uci set firewall.samba_nsds_nt.src="lan"
uci set firewall.samba_nsds_nt.dest="lan"
uci set firewall.samba_nsds_nt.dest_port="137-138"
uci set firewall.samba_nsds_nt.proto="udp"
uci set firewall.samba_nsds_nt.target="NOTRACK"
uci -q delete firewall.samba_ss_nt
uci set firewall.samba_ss_nt="rule"
uci set firewall.samba_ss_nt.name="NoTrack-Samba/SS"
uci set firewall.samba_ss_nt.src="lan"
uci set firewall.samba_ss_nt.dest="lan"
uci set firewall.samba_ss_nt.dest_port="139"
uci set firewall.samba_ss_nt.proto="tcp"
uci set firewall.samba_ss_nt.target="NOTRACK"
uci -q delete firewall.samba_smb_nt
uci set firewall.samba_smb_nt="rule"
uci set firewall.samba_smb_nt.name="NoTrack-Samba/SMB"
uci set firewall.samba_smb_nt.src="lan"
uci set firewall.samba_smb_nt.dest="lan"
uci set firewall.samba_smb_nt.dest_port="445"
uci set firewall.samba_smb_nt.proto="tcp"
uci set firewall.samba_smb_nt.target="NOTRACK"
uci commit firewall
service firewall restart

Remote access is not the default

The source also shows ACCEPT rules for SMB ports. I treat those as a special case on a controlled network; Samba/NAS should normally remain on the LAN or travel through a VPN. Do not expose 137–139/445 to the Internet without understanding update and authentication risks:[26]

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

uci -q delete firewall.samba_nsds
uci set firewall.samba_nsds="rule"
uci set firewall.samba_nsds.name="Allow-Samba/NS/DS"
uci set firewall.samba_nsds.src="lan"
uci set firewall.samba_nsds.dest_port="137-138"
uci set firewall.samba_nsds.proto="udp"
uci set firewall.samba_nsds.target="ACCEPT"
uci -q delete firewall.samba_ss
uci set firewall.samba_ss="rule"
uci set firewall.samba_ss.name="Allow-Samba/SS"
uci set firewall.samba_ss.src="lan"
uci set firewall.samba_ss.dest_port="139"
uci set firewall.samba_ss.proto="tcp"
uci set firewall.samba_ss.target="ACCEPT"
uci -q delete firewall.samba_smb
uci set firewall.samba_smb="rule"
uci set firewall.samba_smb.name="Allow-Samba/SMB"
uci set firewall.samba_smb.src="lan"
uci set firewall.samba_smb.dest_port="445"
uci set firewall.samba_smb.proto="tcp"
uci set firewall.samba_smb.target="ACCEPT"
uci commit firewall
service firewall restart

macOS discovery and reference performance

To support WINS-style discovery, edit /etc/samba/smb.conf.template through Services → Network Shares → Edit Template, inside [global]:[26]

1
2
3
4
5
6
7

[global]
        domain master = yes
        local master = yes
        name resolve order = wins lmhosts hosts bcast
        os level = 99
        preferred master = yes
        wins support = yes

The WINS address can also be advertised through DHCP:[26]

1
2
3

uci add_list dhcp.lan.dhcp_option="44,$(uci get network.lan.ipaddr)"
uci commit dhcp
service dnsmasq restart

The source's reference numbers are not a universal benchmark:[26]

Troubleshooting checklist

• Does ps aux show smbd -D and nmbd -D?[26]
• Did I create accounts and add them to Allowed users?[26]
• Did I run service samba4 restart after editing?[26]
• Is the filesystem driver installed and is the partition mounted?[26]
• After unmounting, can I run fsck.exfat /dev/sda1 if appropriate?[26]
• Does the firewall allow LAN clients to reach the service?[26]

Source

Original source: [Samba]¹, published/updated 2026-08-18.[26]

Sources

[26] https://openwrt.org/docs/guide-user/services/nas/cifs.server — OpenWrt Wiki: Samba