Samba File Sharing on OpenWrt: Configuration, Firewall, and Troubleshooting

Samba on OpenWrt is useful when I want to share a mounted HDD, SSD, or flash drive with Windows, Linux, or macOS clients on the LAN. OpenWrt also offers ksmbd, a lower-resource SMBv3 kernel server with fewer features; this article follows the official luci-app-samba4 path.[26]

Prerequisites

The USB/eSATA drive must already have its driver, filesystem, and mount point. A common package set is:[26]

USB drivers: kmod-usb3 kmod-usb-storage-uas usbutils block-mount mount-utilsFilesystems: kmod-fs-ext4 e2fsprogs kmod-fs-exfat exfat-fsck kmod-fs-ntfs3Drive idle: luci-app-hd-idle

In LuCI, mount the drive under System → Mount Points, enable the entry, click Save & Apply, and use Generate Config if needed. Record the mount point, for example /dev/sda1 becoming /mnt/sda1. The source recommends at least 128 MB RAM; lower-memory machines may need another 128–256 MB of swap.[26]

Install and create a basic share

1. Install luci-app-samba4; dependencies such as samba4-server are installed automatically.[26]
2. Open Services → Network Shares in LuCI.[26]
3. Start with these values:[26]

Field	Example
Interface	lan
Workgroup	WORKGROUP
Enable Extra Tuning	enabled; disable it for Apple Time Machine
Shared Directories	click Add
Name	a share name
Path	/mnt/sda1 or the actual mount point
Browseable	enabled
Read-only	disabled when writes are needed
Force Root	only on a trusted LAN
Allowed users	optional when using accounts
Allow guests	enabled when accounts are not used
Create Mask	0666
Directory Mask	0777

Click Save and Apply. A correctly configured share can then be read and written from the LAN; Windows, for example, can open \\192.168.1.1\\storage\\. I do not expose Samba to the Internet just for convenience.[26]

{{< ads >}}

Use user accounts instead of guest access

When guest access is not appropriate:[26]

1. Add a user entry to /etc/passwd and /etc/group.[26]
2. Choose a UID/GID of at least 1000 to avoid reserved values.[26]
3. Set a Samba password interactively with smbpasswd -a username; do not put the password in an article or repository.[26]
4. Add the account to LuCI → Network Shares → Allowed users, then Save & Apply.[26]

Safe illustrative entries are:[26]

# /etc/passwdfoo:x:1001:1001:smb user:/dev/null:/bin/false# /etc/groupfoo:x:1001:foo

Use chown and chmod for the required filesystem access. Unknown authentication names may be silently mapped to guest by default, so I check both filesystem permissions and Samba access rules.[26]

Advanced configuration outside UCI

After changing configuration files, restart Samba so /etc/samba/smb.conf is regenerated:[26]

service samba4 restart

LuCI/UCI builds the result from /etc/config/samba and /etc/samba/smb.conf.template. If I genuinely need to manage smb.conf beyond UCI:[26]

service samba4 disable

Add this to /etc/rc.local:[26]

smbd -Dnmbd -D

This makes startup and configuration my responsibility; later UCI changes can overwrite the file on boot.[26]

Apple Time Machine share

In Services → Network Shares, create a dedicated share with these important choices:[26]

• Interface lan, Workgroup WORKGROUP.[26]
• Disable Enable Extra Tuning and Force synchronous I/o.[26]
• Enable Enable macOS compatible shares.[26]
• Disable Allow legacy (insecure) protocols/authentication; leave Disable netbios unchecked.[26]
• Shared directory: a name, a path such as /mnt/sda1, Browseable enabled, Read-only disabled.[26]
• Use Force Root only on a secure LAN; prefer a dedicated account.[26]
• Define Allow users and disable Allow guests.[26]
• Create Mask 0600, Directory Mask 0700, Vfs objects disabled.[26]
• Enable Apple Time-machine share; the GB limit may be blank or set.[26]

The source says to disable Enable Extra Tuning for current macOS versions and that an extra avahi service is not needed on OpenWrt.[26]

Check access and startup

If a share will not open, inspect /etc/samba/smb.conf.template, the filesystem driver, and the mount point. As a diagnostic, the source suggests changing security from user to share, restarting the daemons, and trying:[26]

• Windows Explorer: \\router_ip[26]
• Nautilus/Dolphin: press <CTRL>+<L> and enter smb://router_ip/[26]

After installation, confirm the service under LuCI → System → Startup. From the command line:[26]

service samba4 enableservice samba4 start

If Windows does not show the share in Network, install wsdd2.[26]

Cannot write to a share

First check directory permissions and the account. The source lists this test, but 777 grants broad access, so I use it only for diagnosis on a trusted LAN and then narrow the permissions:[26]

chmod -R 777 /mnt/sda1chown -R nobody /mnt/sda1

For an fstab mount, inspect the options, for example:[26]

config 'mount'        option 'options' 'rw,umask=000'        option 'enabled_fsck' '0'        option 'enabled' '1'        option 'device' '/dev/scsi/host0/bus0/target0/lun0/part1'        option 'target' '/mnt/usbdisk'        option 'fstype' 'vfat'

I do not keep umask=000 on a network with untrusted clients.[26]

International characters and LAN firewall

If names containing accented characters cannot be read or written:[26]

sed -i -e "/unix charset/s/ISO-8859-1/UTF-8/" /etc/samba/smb.conf.template

Restart Samba afterwards. With slow NAT paths, the documentation includes a LAN conntrack bypass for SMB ports:[26]

uci -q delete firewall.samba_nsds_ntuci set firewall.samba_nsds_nt="rule"uci set firewall.samba_nsds_nt.name="NoTrack-Samba/NS/DS"uci set firewall.samba_nsds_nt.src="lan"uci set firewall.samba_nsds_nt.dest="lan"uci set firewall.samba_nsds_nt.dest_port="137-138"uci set firewall.samba_nsds_nt.proto="udp"uci set firewall.samba_nsds_nt.target="NOTRACK"uci -q delete firewall.samba_ss_ntuci set firewall.samba_ss_nt="rule"uci set firewall.samba_ss_nt.name="NoTrack-Samba/SS"uci set firewall.samba_ss_nt.src="lan"uci set firewall.samba_ss_nt.dest="lan"uci set firewall.samba_ss_nt.dest_port="139"uci set firewall.samba_ss_nt.proto="tcp"uci set firewall.samba_ss_nt.target="NOTRACK"uci -q delete firewall.samba_smb_ntuci set firewall.samba_smb_nt="rule"uci set firewall.samba_smb_nt.name="NoTrack-Samba/SMB"uci set firewall.samba_smb_nt.src="lan"uci set firewall.samba_smb_nt.dest="lan"uci set firewall.samba_smb_nt.dest_port="445"uci set firewall.samba_smb_nt.proto="tcp"uci set firewall.samba_smb_nt.target="NOTRACK"uci commit firewallservice firewall restart

Remote access is not the default

The source also shows ACCEPT rules for SMB ports. I treat those as a special case on a controlled network; Samba/NAS should normally remain on the LAN or travel through a VPN. Do not expose 137–139/445 to the Internet without understanding update and authentication risks:[26]

uci -q delete firewall.samba_nsdsuci set firewall.samba_nsds="rule"uci set firewall.samba_nsds.name="Allow-Samba/NS/DS"uci set firewall.samba_nsds.src="lan"uci set firewall.samba_nsds.dest_port="137-138"uci set firewall.samba_nsds.proto="udp"uci set firewall.samba_nsds.target="ACCEPT"uci -q delete firewall.samba_ssuci set firewall.samba_ss="rule"uci set firewall.samba_ss.name="Allow-Samba/SS"uci set firewall.samba_ss.src="lan"uci set firewall.samba_ss.dest_port="139"uci set firewall.samba_ss.proto="tcp"uci set firewall.samba_ss.target="ACCEPT"uci -q delete firewall.samba_smbuci set firewall.samba_smb="rule"uci set firewall.samba_smb.name="Allow-Samba/SMB"uci set firewall.samba_smb.src="lan"uci set firewall.samba_smb.dest_port="445"uci set firewall.samba_smb.proto="tcp"uci set firewall.samba_smb.target="ACCEPT"uci commit firewallservice firewall restart

macOS discovery and reference performance

To support WINS-style discovery, edit /etc/samba/smb.conf.template through Services → Network Shares → Edit Template, inside [global]:[26]

[global]        domain master = yes        local master = yes        name resolve order = wins lmhosts hosts bcast        os level = 99        preferred master = yes        wins support = yes

The WINS address can also be advertised through DHCP:[26]

uci add_list dhcp.lan.dhcp_option="44,$(uci get network.lan.ipaddr)"uci commit dhcpservice dnsmasq restart

The source’s reference numbers are not a universal benchmark:[26]

Device/condition	Read	Write
WRT3200ACM, USB3 NTFS, 1Gb LAN, OpenWrt 23.05	100 MB/s	110 MB/s
GL-MT6000, USB3 exFAT, 1Gb LAN, OpenWrt 24.10	85 MB/s	115 MB/s
N100, USB3 exFAT, 1Gb LAN, OpenWrt 24.10	120 MB/s	120 MB/s

Troubleshooting checklist

• Does ps aux show smbd -D and nmbd -D?[26]
• Did I create accounts and add them to Allowed users?[26]
• Did I run service samba4 restart after editing?[26]
• Is the filesystem driver installed and is the partition mounted?[26]
• After unmounting, can I run fsck.exfat /dev/sda1 if appropriate?[26]
• Does the firewall allow LAN clients to reach the service?[26]

Source

Original source: [Samba]¹, published/updated 2026-08-18.[26]

Sources

[26] https://openwrt.org/docs/guide-user/services/nas/cifs.server — OpenWrt Wiki: Samba

Footnotes

1. https://openwrt.org/docs/guide-user/services/nas/cifs.server — Samba. ↩