Which Ports Should Be Filtered Out to Protect a Network From SMB Attacks: Critical TCP Ports to Block

I learned the hard way that open SMB ports are an invitation. 💡 Back in my Microsoft days, we saw entire networks compromised through TCP 445 alone—EternalBlue exploited this exact vulnerability.

The fix is straightforward: block 139 and 445 at your firewall. These ports power SMB file sharing, and while useful internally, they’re a beacon for attackers scanning the internet.

You’ll stop lateral movement cold. No more ransomware spreading via SMB, no more credential theft. The rule takes 5 minutes to implement in any firewall—Windows Defender Firewall, pfSense, you name it.

Just remember: if you need internal SMB access, restrict it to trusted IPs. Never expose these ports to the world.

What Youll Need

Step-by-Step Instructions for Filtering Ports Against SMB Attacks

Here’s the method I use to lock down networks against SMB-based threats without breaking functionality.

Start by auditing your firewall rules for the primary SMB ports: TCP 445 (SMB over direct TCP), TCP 139 (NetBIOS Session Service), and UDP 137-138 (NetBIOS Name/Datagram Services). These are the critical attack vectors for exploits like EternalBlue.

Use netstat -ano or a network scanner to confirm if these ports are open on any internal systems. I always check both Windows servers and legacy devices—older NAS units often expose these ports by default.

Create deny rules for TCP 445, TCP 139, UDP 137, and UDP 138 from external sources. For internal segmentation, block these ports between untrusted subnets (e.g., guest Wi-Fi to corporate LAN).

If you must allow SMB for file sharing, restrict it to specific IPs using source/destination pairs. Never permit these ports globally. Test with nmap -p 139,445 to verify the ports are closed from unauthorized networks.

On Windows systems, disable SMBv1 entirely via PowerShell: Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol. This version is riddled with vulnerabilities and should never be exposed.

For SMBv2/v3, ensure they’re patched to the latest updates. Use Group Policy to enforce SMB signing (set RequireSecuritySignature=1), which prevents relay attacks even if ports are open.

Configure your firewall or IDS to log all connection attempts to TCP 445 and TCP 139. Tools like Wireshark or Zeek can alert on suspicious SMB traffic patterns, such as repeated failed authentication.

I’ve caught multiple brute-force attempts this way. Set up alerts for 10+ connections per minute to these ports—it’s a red flag for an ongoing attack.

Run a controlled test using Metasploit’s smb_version module or Nmap’s smb-enum-shares script from an external network. Confirm that no SMB services are reachable and that legacy versions are disabled.

Re-test after any major changes, like adding new servers or VPN gateways. Real talk: A single unpatched device can reinfect your entire network. Stay vigilant.

Tips and Common Mistakes

These practical insights will help you tighten security without disrupting legitimate network functions.

Port Audit Priority: In Step 1, don’t overlook legacy devices—I’ve found unpatched NAS units and old print servers exposing TCP 445 more often than modern workstations. Use netstat -ano on every machine, not just servers, to catch these hidden exposure points.

Segmentation Strategy: For Step 2, remember that internal threats matter too. Block TCP 139 and UDP 137-138 between guest networks and production systems, not just at the external firewall. I once stopped a lateral movement attack by enforcing this between VLANs.

Validation Technique: In Step 5, don’t just run penetration tests once. Schedule quarterly tests and after any infrastructure changes. I use Metasploit’s smb_version module from a VM on a separate network segment to simulate real attack paths.

Monitoring Thresholds: For Step 4, set your alerts at exactly 10+ connections per minute as specified. This catches brute force attempts without creating noise from normal traffic. I’ve adjusted SIEM rules to trigger at this precise threshold with great results.

Frequently Asked Questions

To defend against SMB attacks, blocking ports 139, 445, and related UDP ports is a critical first step. 💡 Take action today by auditing your firewall rules and ensuring these vulnerable entry points are secured. Stay proactive—regularly update your defenses to stay ahead of evolving threats!