Is port 445 (SMB) exposed to the internet?
Port 445 runs SMB (Server Message Block), the Windows file- and printer-sharing protocol, and it was never designed to be reached from outside a trusted local network — a flaw in an older version of the protocol, SMBv1, is what the EternalBlue exploit (CVE-2017-0144) used to let WannaCry and NotPetya spread between machines with no credentials and no user interaction at all, and CISA still names SMB a high-risk service that should be blocked at the network boundary today.
By AdminKit team, Netbase JSC · Updated November 1, 2026
Why port 445 shouldn’t normally face the internet
IANA registers TCP port 445 for microsoft-ds, the direct-hosted transport for SMB (Server Message Block) — the protocol Windows, and compatible implementations like Samba, use for file sharing, printer sharing and some remote administration. SMB was designed to run between machines on the same trusted local network, the same assumption behind several other protocols covered elsewhere on this site, and a server or NAS box that answers on 445 from the open internet is offering exactly that trusted-network feature to anyone who happens to scan for it.
What an exposed port 445 actually gives away
The starkest example is historical but still the reason CISA’s guidance exists at all: EternalBlue (CVE-2017-0144), a flaw in the older SMBv1 protocol version, let the WannaCry and NotPetya ransomware outbreaks of 2017 spread from one internet-reachable, unpatched machine to the next with no credentials and no user interaction whatsoever — a worm, not a phishing email or a tricked click. CISA’s own Petya ransomware alert names it directly: NotPetya used “EternalBlue — the same Windows SMBv1 exploit used by WannaCry.” Patched, SMBv3-only hosts aren’t vulnerable to that specific exploit, but a reachable port 445 is still useful to an attacker in quieter ways: it confirms a Windows or Samba host with file sharing lives at that address, and it opens the door to credential-guessing against any share that requires a login, or to NTLM relay attacks that abuse SMB’s authentication handshake rather than a code flaw.
Why this isn’t just 2017’s problem
CISA’s guidance on SMB exposure has been reissued, not retired. Its dedicated SMB Security Best Practices alert and its Petya ransomware alert both give the identical recommendation: “block all versions of SMB at the network boundary by blocking TCP port 445 with related protocols on UDP ports 137-138 and TCP port 139, for all boundary devices” — not just SMBv1. A separate, more recent joint CISA/FBI advisory on initial-access techniques (AA22-137A) groups SMB with three other protocols this site also covers, stating that “RDP, Server Message Block (SMB), Telnet, and NetBIOS are high-risk services” — see RDP and VNC exposed to the internet and securing an exposed Telnet device for the same pattern on those other three.
How to check your own exposure
AdminKit’s planned open ports check is designed to test whether port 445 and other commonly-exposed management ports on your own public IP respond from outside your network. A file server, NAS box or Windows host can be fully patched to the latest SMB version and still be reachable on 445 from the internet simply because of a router’s UPnP rule or a cloud firewall rule nobody remembers adding — worth confirming directly with what is my IP and the port check above rather than assuming the perimeter is closed.
How to fix it
- Block TCP 445, TCP 139 and UDP 137-138 at your perimeter firewall or router, exactly as CISA’s advisory recommends, so SMB only answers requests from your internal network.
- Disable SMBv1 entirely on every host that still has it enabled — current Windows and Samba releases support this as a feature to turn off, and it closes the specific flaw EternalBlue exploited without affecting modern SMBv3 file sharing.
- Require SMB signing so a session can’t be tampered with or relayed in transit, closing the NTLM relay path that doesn’t depend on any unpatched code flaw.
- Route any file sharing you genuinely need between sites or for remote staff through a VPN, instead of forwarding port 445 directly — the same fix this site recommends for RDP and VNC, since none of these protocols were designed to have their login or session-negotiation step reachable by an anonymous scanner.
CISA’s own guidance adds a fair caveat worth repeating: “disabling or blocking SMB may create problems by obstructing access to shared files, data, or devices” — weigh that disruption against the risk, and if internal file sharing genuinely depends on SMB, the fix is restricting where it’s reachable from, not necessarily turning it off altogether.
Defensive use only
Every check this page links to is for assets you own or are explicitly authorized to test. Never scan, probe, or attempt to connect to a network or device you don’t control — AdminKit’s active checks only ever run against the IP making the request or an asset you’ve verified ownership of. See our Disclaimer and Acceptable Use Policy for the full terms.
This guide is general information, not a security audit of your specific network — see our disclaimer for what AdminKit's guidance does and does not commit to.
Frequently asked questions
Is SMB itself broken, or was it just one bad version?
The wormable EternalBlue exploit specifically targeted a flaw in SMBv1, an old version of the protocol still enabled by default on many older Windows installations in 2017. Current SMB versions (3.x) with signing and encryption enabled are far more robust, but CISA's guidance is still to block all versions of SMB at the network boundary, not just SMBv1 — an internet-facing SMB port is a high-risk service regardless of which version answers.
Why would my SMB port ever be reachable from the internet in the first place?
Usually a misconfigured firewall rule, a router's UPnP feature opening a port automatically for a NAS or file-sharing device, or a cloud server built from a Windows image with a default or broad inbound rule that was never tightened. Nobody sets out to expose SMB directly; it almost always happens as a side effect of something else.
What can someone actually do with a reachable port 445?
If SMBv1 is still enabled and unpatched, a wormable remote-code-execution exploit like EternalBlue requires no credentials and no user interaction at all. Even on a patched, SMBv3-only host, a reachable port 445 still exposes file shares to credential-guessing and NTLM relay attacks, and simply confirms to any scanner that a Windows (or Samba) host with file sharing lives at that address — information an attacker uses to plan the next step.
What does CISA actually recommend?
CISA's dedicated SMB Security Best Practices alert recommends "disabling SMBv1" and "blocking all versions of SMB at the network boundary by blocking TCP port 445 with related protocols on UDP ports 137-138 and TCP port 139, for all boundary devices" — the same guidance it repeated in its Petya ransomware alert. A separate joint CISA/FBI advisory on initial-access techniques groups SMB with RDP, Telnet and NetBIOS, stating plainly that "RDP, Server Message Block (SMB), Telnet, and NetBIOS are high-risk services."
I need file sharing between my own sites or for remote staff — what's the safe way to do that?
Put SMB traffic inside a VPN or a zero-trust access tunnel between the specific sites or users that need it, rather than forwarding port 445 on a router or cloud firewall. That keeps the protocol reachable for people who have already authenticated onto the private network, while an internet scanner finds nothing listening on 445 at your public IP at all.
Want AdminKit to watch this for you?
Free checks tell you the state today. Protective DNS and monitoring tell you when it changes.
Talk to an expert
Huy Nguyen (David), Founder & CEO, Netbase JSC
Ask whether this fix applies to your setup, or get a second pair of eyes on your DNS and mail records.