Install the SMB Proxy Node

1. Confirm the traffic path

The SMB node needs a stable client-facing IP and reachability to the real file server. Clients will connect to the Axiom IP, not the file-server IP. Plan firewall policy so client VLANs can reach Axiom TCP 445 and only Axiom can reach the backend server TCP 445.

2. Run the installer

chmod +x axiom-installer.sh
sudo ./axiom-installer.sh

Choose smb_proxy. Enter:

• Management URL, including http:// or https:// and port 8443
• Enrollment token copied from Management Settings
• Whether to trust a self-signed Management certificate for evaluation
• Node ID and display name
• NIC and IP for the encrypted node control listener on TCP 9443
• One or more proxy NICs
• Listen IP and port, normally the NIC IP and 445
• Target file-server IPv4 and port 445

Use a clear node ID that remains stable across restarts and upgrades.

3. Verify enrollment and listeners

sudo systemctl status axiom --no-pager
sudo ss -ltnp | egrep ':445|:9443'
sudo journalctl -u axiom -n 160 -l --no-pager

Expected logs include the SMB proxy listener, node control listener, node agent, and successful runtime configuration or reputation-feed synchronization. In Management, verify the node is online and its last report is current.

4. Validate a benign transfer

From a test Windows client, open \\AXIOM_SMB_IP\share, authenticate to the real file service, and upload a known benign file. Confirm:

• The file arrives intact.
• Forwarded and uploaded byte counters increase by a reasonable amount.
• A live connection appears during the copy.
• The file transfer ledger records file name, client IP, direction, and size.
• The backend TCP connection originates from the SMB node.

5. Validate enforcement

Use a harmless text fixture, calculate its SHA-256, and add that hash to Security > Reputation Center as known_bad. Set the known-bad action to Block, save policy, and wait for the node delivery acknowledgement.

Close the existing Windows SMB connection before retesting:

net use * /delete /y

Copy the exact fixture again. Windows should report a failed copy, the file must not remain on the share, and Management should record the hash, client IP, node, path, and block reason.

6. Prevent bypass

After validation, enforce network policy:

• Deny client networks to the backend file server on TCP 445.
• Allow SMB node IP to backend file server TCP 445.
• Allow client networks to SMB node TCP 445.
• Keep Linux IPv4 forwarding disabled on the SMB node.
• Do not publish backend DNS names or routes that let clients bypass Axiom.

Blocking a connection can appear to Windows as a generic SMB error because the current enforcement terminates the unsafe stream. Use the Management event and SMB node log as the authoritative reason.