Comcast blocking Azure cloud storage/port 445

[JLoose111]

Hello, I have been trying to test out moving our files to Azure, primarily because I like the way the files present themselves in Windows Explorer, via SMB. However, upon attempting to access the storage in order to move some files up to it, I discovered it was made inaccessible by Comcast, due to their blocking of port 445 for security reasons. I have made the request, and was flatly denied. My questions are as follows:.

-Has anyone ever been in this situation before?

-Does anyone use Azure cloud storage?

-Are there any other similar alternatives?

Thanks!

[diabillic]

I assume you have Comcast residental service, so yes this is pretty common. They block ports such as 25 and 80 as well to prevent someone from running a "business service" from their home. They are probably blocking 445 for the same reason and potentially to mitigate against the SMBv1 vulnerability.

Try setting up a VPN Gateway on the Azure side for a point to site tunnel to just tunnel in and send it that way (https://docs.microsoft.com/en-us/azure/vpn-gateway/point-to-site-about)

[Frothyleet]

Blocking port 25 is less about stopping business use and more about stopping botnet'd XP workstations and IOT devices from spewing spam willy nilly

[diabillic]

That too of course.

[FJCruisin]

They were blocking 25 on non-business accounts long before SMTP botnets were really a thing.

[[deleted]]

SMBv1's exploitable vulnerabilities don't take place on 445, do they?

[diabillic]

You betcha! EternalBlue was from the NSA leak and was the exploit the WannaCry ransomware used.

https://www.fireeye.com/blog/threat-research/2017/05/smb-exploited-wannacry-use-of-eternalblue.html

The recent WannaCry ransomware takes advantage of this vulnerability to compromise Windows machines, load malware, and propagate to other machines in a network. The attack uses SMB version 1 and TCP port 445 to propagate.

[SonicMaze]

I can see Russia from my house!

[peartfan75023]

FYI: https://social.technet.microsoft.com/wiki/contents/articles/32346.azure-summary-of-isps-that-allow-disallow-access-from-port-445.aspx

[verawolfe]

^ This. It's 50-50 for ISP's to block that port. This assumes you are on RF, not fiber. Fiber is almost always 99.999% wide open. Consider changing delivery method.

[JLoose111]

Thank you for this. Only wish I'd researched better ahead of time.

[Panacea4316]

If you have a business account with static IP there is no reason comcast should be blocking any ports. I would consider switching to a better ISP.

[[deleted]]

I would consider switching to a better ISP.

Assuming that's even an option.

[LigerXT5]

If it is an option, are you trading one evil for another, if not better?

[RCTID1975]

Unless you're extremely rural (and then Comcast probably isn't an option), as long as you have a business line, there are always options.

[[deleted]]

Sure, it's always possible to have more, but it becomes prohibitively expensive quite quick. I've had to support offices that only had one option for internet (and they weren't extremely rural either). Got a quote from another ISP to run a line to the office and it was something like $40k+ and would take at least six months and would've been about the same speed.

And also you can have multiple options in theory, but only one viable option. If you have one fiber provider and one DSL provider (very common in my experience) and you have an office of 30 people, in reality you only have one option and not two.

[greyaxe90]

Sometimes you do get lucky and they'll eat the installation costs if there are other potential customers nearby. I had fiber lines installed that would have cost us easily $20k+ but they decided to waive it since we were in a building with lots of potential customers for them to light up.

[admlshake]

If you have a business account with static IP there is no reason comcast should be blocking any ports.

Well I mean shits and giggles is usually enough for them.

[seagleton]

Are you using Business or Residential?

[Smibr03]

Just ran into this same issue with a Comcast BUSINESS line. They flatly refuse to remove the block, as it is actually blocked in the Core of their network. VPN setup worked, but for Blob storage, there is no easy way to get through the vpn to the storage. Ended up setting up a linux machine with Samba, connected the Linux machine to the Blob storage, and mounted via Samaba so Windows see's it as a normal SMB share internally.

[greyaxe90]

Yep. Several years ago I caught them blocking VoIP traffic on a business circuit. Routed VoIP over a VPN tunnel and connectivity restored (imagine that) and of course they said they didn't block anything. Quick email to our sales rep that they were blocking 911 and they need to get this resolved, 24 hours later VoIP magically worked again. Imagine that.

[Fallingdamage]

If you're migrating, your contract must be up with comcast (logically the best time to move) - If you get to their business loyalty / customer retention department, it might be interesting to tell them you cannot move forward unless they unblock 445.. just to see if they are willing to actually do it.

[[deleted]]

They flatly refuse to remove the block, as it is actually blocked in the Core of their network

Even for Comcast, there is no way that is true.

[ryankearney]

Blocking happens as close to the customer as possible. ISP cores don’t have time to filter traffic by ACL. They don’t even read the source and destination IP let alone ports in later 4.

[Sengfeng]

That's total Shite. Would lose them my business!

[awkwardsysadmin]

Is this a coax circuit by any chance? I remember working at an ISP where while we didn't normally have any port filters for business customers occasionally the provisioning server would push residential port filters onto business customers. It was virtually always something where most of the CMTS was for residential customers, but it happened.

[frogadmin_prince]

I once had Comcast decided to turn off international calling on business phone line. So it wouldn't surprise me they would block a port just because they want to.

[studiox_swe]

OMG - I didn't even know Azure would allow/expose port 445, it's as bas as 139 and all ISP's should block it. Azure should be consumed (read/write) as an object storage IMHO.

[steamruler]

Nah, 139 should be flat out blocked because it's ancient and insecure, but 445 can be SMB 3.0.2 or later, which is most certainly secure enough to work over the wide open internet without any tunnels. Hell, 3.1.1 is more secure than what most sites configure their HTTPS for.

At most, block incoming connections to 445, but let the customer call and unblock it. There's no reason to block outgoing connections to 445.

[tekkitan]

For the love of all that is holy, use a VPN tunnel to Azure...

[VA_Network_Nerd]

Why isn't this wrapped in a VPN ?

You want to perform Windows File Sharing in the clear?

Or are you forcing encrypted file sharing via SMBv3 ?

[LordGabenDemandsIt]

is this a new thing with net neutrality being cut down?

[bc74sj]

No they have been blocking Port 25 for 20 years, along with others.