To block port 135 on Windows 11, you must create a specific outbound and inbound rule in the Windows Defender Firewall with Advanced Security. This prevents Remote Procedure Call (RPC) traffic from entering or leaving your system, which is critical for mitigating attacks like WannaCry that exploit this legacy protocol.
Port 135 is used by Microsoft's RPC service, which allows programs to communicate over a network. While necessary for some enterprise environments, it is a primary target for malware. Blocking it significantly reduces your attack surface, though it may break certain legacy applications or domain services that rely on dynamic port allocation following the initial handshake on port 135.
Understanding Port 135 and RPC
Before modifying firewall settings, it is important to understand what port 135 does. The Endpoint Mapper listens on TCP port 135 to assign specific RPC requests to dynamic ports. When you block port 135, you prevent the initial handshake. However, note that RPC uses a range of dynamic high-numbered ports as well. For most home users and general security hardening, blocking port 135 is sufficient to stop automated worm propagation. If you are managing a domain environment, consult your IT administrator before proceeding, as this can disrupt Active Directory replication or group policy updates.
For more information on securing your network connections, you might find our guide on
Troubleshooting RDC through VPN Not Working on a Specific Windows Computer helpful, as remote desktop also relies on network protocols that interact with firewall rules.
Creating the Outbound Rule
The first step is to prevent your computer from initiating connections to port 135 on other machines. This stops potential lateral movement if your machine becomes infected.
1. Press
Win + R, type
wf.msc, and press Enter to open the Windows Firewall with Advanced Security console.
2. In the left pane, click on
Outbound Rules.
3. In the right pane, under the Actions menu, click
New Rule....
4. Select
Port and click Next.
5. Choose
TCP and enter
135 in the specific local ports field. Click Next.
6. Select
Block the connection. Ensure all three profiles (Domain, Private, Public) are checked unless you have a specific reason to allow one. Click Next.
7. Name the rule "Block RPC Port 135 Outbound" and add a description if desired. Click Finish.
Creating the Inbound Rule
Next, you must prevent external systems from reaching your RPC endpoint mapper. This is the most critical step for defense against remote exploits.
1. In the same
wf.msc window, click on
Inbound Rules in the left pane.
2. Click
New Rule... in the right Actions pane.
3. Select
Port and click Next.
4. Choose
TCP and enter
135 in the specific local ports field. Click Next.
5. Select
Block the connection. Again, ensure Domain, Private, and Public profiles are selected. Click Next.
6. Name the rule "Block RPC Port 135 Inbound" and click Finish.
You should repeat these steps for UDP port 135 as well, although TCP is the primary vector for most known exploits. Creating separate rules for UDP ensures comprehensive coverage.
Verifying the Block Status
A common issue reported by users is that tools like
nmap still show port 135 as open or filtered after applying the rules. This discrepancy often arises because the scanner might be detecting the state before the rule fully propagates, or because the RPC service is still running locally even if blocked externally.
To verify the rule is active:
1. Open PowerShell as Administrator.
2. Run the command:
Get-NetFirewallRule -DisplayName "Block RPC Port 135 Inbound".
3. Check the
Enabled property. It should return
True.
If
nmap reports the port as open, try scanning from a different machine on a different network segment. Sometimes, local loopback traffic behaves differently than external traffic. If you suspect the rule is not working, check your event logs for any denied connection attempts under Windows Firewall logging, which can be enabled in the same Advanced Security console under Properties.
For users interested in broader system controls, see our article on
Restrict Folder Access to Guest Account on Windows 11 Home to further limit unauthorized access vectors.
Frequently Asked Questions
Will blocking port 135 break Remote Desktop?
No, Remote Desktop Protocol (RDP) primarily uses port 3389. While RDP may use RPC for some negotiation features, the core connection does not depend on port 135 being open for standard remote sessions. You can safely block 135 without losing RDP functionality.
Why does nmap still show port 135 as open?
This usually happens if the scan is performed locally via loopback or if the RPC service is responding on a dynamic port rather than the endpoint mapper. Ensure you are scanning from an external IP address and that your firewall rules are applied to the correct network profile (Public/Private).
Can I block port 135 only for specific applications?
Yes, but it requires advanced configuration. Instead of creating a generic port rule, you would need to create rules based on the executable path of the application. However, since RPC is a system-level service, blocking it globally is the standard approach for security hardening.
What happens if I need to use RPC for a legitimate app?
If a specific application fails after blocking port 135, you can create an exception rule. Go to the Inbound Rules section, create a new rule for Port 135, select "Allow the connection," and specify the program path of the required application in the scope or action settings.
Is it safe to block port 135 on Windows 11 Home?
It is generally safe for home users who do not participate in complex domain networks or file sharing setups that rely heavily on legacy RPC. Most modern file sharing uses SMB over TCP 445, which operates independently of the RPC endpoint mapper on port 135.