Should Windows file sharing (SMB, port 445) answer from the internet?

What is SMB?

Server Message Block (SMB) is how Windows computers share folders and printers. It uses TCP port 445.

Inside the office it is normal. Answering on the internet, it lets anyone try to reach your shared folders.

Why does it matter?

Microsoft SMBv1 Remote Code Execution Vulnerability 2022-02-10 The SMBv1 server in multiple Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets.

CISA lists an SMBv1 flaw in its catalog of exploited flaws. CISA added it to its catalog on 10 February 2022.

Shared folders hold client files. A server that answers on 445 from outside gives attackers a direct path to them.

What do I do about it?

Block TCP port 445 inbound from the internet at your corporate hardware firewalls. Blocking inbound SMB traffic protects devices inside your network by preventing access from the internet.

Microsoft says to block TCP port 445 inbound from the internet at your firewall. Blocking inbound SMB keeps outside traffic away from devices inside your network.

1. Block TCP port 445 inbound in your firewall settings.
2. Remove any port forwarding rule for 445 in your router.
3. Turn off SMBv1 on every Windows computer and server.
4. Give remote staff a VPN rather than open file sharing.