Making Your Ubuntu Samba File Server Accessible From Outside

Check your network interface name.
Names like eth0 or ens33 are typically used.

By default, /etc/netplan/01-network-manager-all.yaml contains the following.

For reasons explained below, we're aiming to expose this over IPv6 rather than IPv4.
That way, the router-side setup should work fine even on DS-Lite.

Configure Samba to listen on IPv6.
Add the following lines to the [global] section of /etc/samba/smb.conf

Add the ports Samba needs to your firewall rules.

sudo ufw allow samba

sudo ufw reload
Reloads the firewall configuration so the rule you just added takes effect.

sudo ufw allow from any to any port 445 proto tcp
sudo ufw reload

Writing it as above opens only TCP port 445.

You can check which ports are open with ufw status.

If you opened something by mistake, remove it with the following command.

So the connection keeps working even if the server's IP address changes,
I decided to use DDNS via https://noip.com.

• Creating a domain on noip.com (something like sample.ddns.net)
• Installing and configuring ddclient with apt

I'll assume you've already got this set up before moving on.
You can check whether it's working with the following command.

sudo systemctl status ddclient

If you haven't set this up yet, check out this article.

Set up L2TP/IPsec or OpenVPN and access the internal network over the VPN.
This lets you get around the limitations of DS-Lite.

Create and initialize the PKI directory

make-cadir ~/openvpn-ca
cd ~/openvpn-ca
./easyrsa init-pki

make-cadir is an Easy-RSA command that creates a directory containing your OpenVPN configuration.

Building the CA
Running this command
will prompt you with:
Common Name(eg: your user, host, or server name)[server]:
Go ahead and enter a name.

Creating the server certificate

Creating the server key

Generating the DH parameters

Create a certificate and key for the client.
Pick any name you like for the client (e.g., client1).

Copy the generated certificates and keys into the OpenVPN directory.

Create the file /etc/openvpn/server.conf
and add the following content.

Start the OpenVPN service and set it up to start automatically at boot.

Create the client configuration file (.ovpn). For example, create a file named client1.ovpn with the following content.

The remote hoge.ddns.net is the DNS you created earlier via https://noip.com for your dynamic IP.

Along with the client configuration file,
copy ca.crt, client1.crt, and client1.key
to your client device (a MacBook, in my case) using something like a USB drive.

client
dev tun
proto udp
remote hoge.ddns.net 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client1.crt
key client1.key
remote-cert-tls server
cipher AES-256-CBC
verb 3

Open the OpenVPN port in your firewall settings.

Since I'm using a MacBook Air, I went with Tunnelblick.

For Tunnelblick, just drag and drop the hoge.ovpn file you copied over to the client (MacBook) earlier.

You'll then be asked whether it's for you only or for all users —
for this use case, "for you only" is fine.

I'm using a TP-Link Archer AX10 router.
Here's how I configured it.

If you're using TP-Link too, go to https://tplinkwifi.net/ to get into the admin panel.

First, DS-Lite, MAP-E, and v6 plus don't let you configure port settings,
so you need to pick something else. (Source: https://www.tp-link.com/jp/support/faq/2799/)
That means you'd need to switch to PPPoE.
For an article on the differences between these connection types, see this one

However, if it's the same router you use day-to-day, switching to PPPoE ends up feeling slower than DS-Lite.
So in the end, I decided to drop the IPv4 connection approach entirely.