Which FW rules to make smb safer (and still usable) in Win and Mac?

Understanding SMB Security Risks

SMB (Server Message Block) is a protocol used for providing shared access to files, printers, and other resources on a network. While convenient, it has historically been a target for attacks such as ransomware propagation (e.g., WannaCry) and unauthorized access attempts. The primary vulnerability lies in its default configuration, which often allows connections from any IP address on the network, including untrusted or guest networks. By hardening firewall rules, you can significantly reduce the attack surface without breaking legitimate file sharing workflows.

Configuring Windows Firewall Rules

Windows includes built-in firewall profiles that can be customized to allow SMB traffic only from specific sources. The most critical port for modern SMB communication is TCP 445. Older versions of SMB may use ports 139 (TCP) and UDP 137-138 for NetBIOS name resolution and datagram services.

1. Open Windows Defender Firewall with Advanced Security from the Start menu.
2. Navigate to Inbound Rules and click New Rule.
3. Select Port and choose TCP, then specify Specific local ports: 445.
4. Allow the connection for Domain, Private, and Public profiles (though Public should ideally be blocked). Restrict this rule to specific IP ranges using the Scope tab if possible.
5. Repeat steps for UDP ports 137, 138, and TCP port 139 if legacy compatibility is needed.
6. Create an outbound rule with similar restrictions if strict egress filtering is part of your security policy.

It is crucial to disable NetBIOS over TCP/IP on interfaces that do not require it. This prevents unnecessary broadcast traffic and reduces exposure to NetBIOS-specific exploits. In the Network Connections properties, under IPv4 settings, advanced options allow you to disable NetBIOS on a per-interface basis.

Securing SMB on macOS

macOS uses a different firewall management interface but achieves similar results through Application Layer Filtering. By default, macOS allows incoming connections for certain services, including file sharing, which can be restricted.

• Go to System Settings > Network > Firewall.
• Enable the firewall if it is not already active.
• Click Options to manage application permissions.
• Locate File Sharing (which uses SMB) and ensure it is set to Allow only locally connected computers if available, or remove it from allowed apps entirely if manual control is preferred.
• For granular control, use pf (Packet Filter), the BSD-based firewall in macOS. Edit /etc/pf.conf to block inbound traffic on port 445 except from trusted subnets.

Additionally, macOS supports SMB signing and encryption in newer versions. Ensure that SMB Signing is enabled in the sharing preferences to prevent man-in-the-middle attacks. If your environment supports it, enabling SMB Encryption adds an extra layer of protection for data in transit.

Balancing Safety and Usability

Strict firewall rules can sometimes break functionality for users who need to access shared drives from various locations. To maintain usability, consider implementing a Virtual Private Network (VPN) for remote access rather than exposing SMB directly to the internet. For local network users, restricting access by subnet ensures that only devices within your office or home network can connect.

If you are managing multiple systems, group policies (GPO) in Active Directory can automate these firewall configurations across all Windows machines. For Macs, Mobile Device Management (MDM) solutions like Jamf Pro can push pf rules and system configurations consistently. This centralized approach reduces administrative overhead and ensures uniform security posture.

Another consideration is the version of SMB being used. SMBv2 and SMBv3 include significant security improvements over SMBv1, including mutual authentication and encryption. Ensure that both Windows and Mac clients are configured to prefer SMBv3 and disable SMBv1 entirely. Disabling SMBv1 removes the risk of MS17-010 vulnerabilities, which were widely exploited in past ransomware attacks.

Regularly audit your firewall logs to identify any denied connections that might indicate scanning or brute-force attempts. On Windows, check the Security Event Log for event ID 5156 (Filtering Platform Connection) and 5158 (Filtering Platform Drop). On Mac, review /var/log/system.log or use Console.app to monitor pf drop events. These logs provide valuable insights into potential threats and help refine your rules over time.

For teams needing seamless cross-platform collaboration, consider alternative protocols like WebDAV or cloud-based storage solutions that offer built-in security features. However, for local high-speed transfers, hardened SMB remains the most efficient option. Always test changes in a non-production environment before deploying them broadly to avoid disrupting critical workflows.

Frequently Asked Questions

Can I completely disable SMB on my network?

Yes, you can disable SMB entirely if your organization does not rely on local file sharing. This eliminates the attack vector completely. However, many applications still depend on SMB for printer sharing or domain controller communication, so assess dependencies first.

Why do I still get blocked after opening port 445?

You may have additional security layers such as antivirus firewalls or third-party endpoint protection software overriding Windows Firewall rules. Check these applications’ settings to ensure they are not blocking inbound SMB traffic despite your firewall configuration.

Is SMBv1 safe to enable for legacy devices?

No, SMBv1 is considered unsafe due to multiple known vulnerabilities, including EternalBlue. It should never be enabled on modern systems. Instead, upgrade legacy devices to support SMBv2 or v3, or isolate them on a separate VLAN with strict access controls.

How do I verify if SMB encryption is working on Mac?

Use the smbutil statshares command in Terminal to view details of active SMB shares. Look for the encrypt flag indicating that encryption is active for the connection. If it is missing, check the server’s sharing preferences to ensure encryption is enforced.

What happens if I block UDP ports 137-138?

Blocking these ports disables NetBIOS name resolution, which may cause issues for older Windows clients relying on NetBIOS names instead of DNS. Modern systems typically use DNS, so blocking these ports is generally safe and recommended for improved security.