Is it safe to have port 445 open to the internet?

No. Port 445 is Windows file sharing (SMB). It should never be reachable from the internet. It is how the WannaCry and NotPetya outbreaks spread, and it exposes file shares and Windows logins to password guessing. Block it at your router or firewall.

How do I share files remotely without opening port 445?

Connect to the office over a VPN and use file shares as normal, or move shared files to a cloud service such as OneDrive, SharePoint, Google Drive or Dropbox. Your NAS vendor's own remote-access app is another option.

Should I disable SMBv1?

Yes. SMBv1 is decades old and was the version WannaCry exploited. Microsoft no longer installs it by default on current Windows versions. Turn it off on servers and NAS devices unless a very old device truly needs it, and plan to replace that device.

High risk Port 445 · SMB Windows file sharing

SMB port 445 is open: what it means and how to fix it

By Stephane Meus, CEH, PenTest+ · Updated 11 October 2026 · 6 minute read

Short answer: port 445 is SMB, the protocol Windows uses for shared folders and printers. It's meant for your office network only. Open to the internet, it lets anyone try to log in to your file shares, and it's the port the WannaCry and NotPetya attacks used to spread across the world in 2017.

The fix: block port 445 from the internet at your router or firewall. For remote access to shared files, use a VPN or a cloud file service instead.

What is port 445?

SMB (Server Message Block) is how Windows computers share files and printers. When you open a mapped drive like \\server\shared, that's SMB on port 445. Network storage boxes (NAS) from Synology, QNAP and others also use SMB, as do Linux servers running Samba.

SMB was designed for trusted local networks. Microsoft's own guidance is to block port 445 at the edge of your network, so it can't be reached from the internet.

How it usually ends up exposed:

A router port forward added so someone could reach files from home.
A NAS with "remote access" turned on in a way that opens SMB directly.
A cloud server (Azure, AWS) whose firewall rule allows 445 from anywhere.
A router set to DMZ mode, which exposes every port on one computer.

Why an open port 445 is high risk

It's how worms spread. In 2017, WannaCry used a flaw in SMBv1 called EternalBlue (MS17-010) to infect hundreds of thousands of computers in about a day, with no clicking needed. NotPetya used the same flaw weeks later. Unpatched machines on an exposed 445 are still attacked today.
More SMB flaws followed. SMBGhost (CVE-2020-0796), for example, affected SMBv3 on some Windows 10 versions and could also spread without a login.
Windows logins are exposed. SMB accepts Windows usernames and passwords, so bots can guess passwords for real accounts, and a successful guess gives access to your files.
It's a ransomware favorite. Once attackers reach shared folders, they can encrypt everything stored there.

How it looks in your report your-office-ip

445 SMB file sharing A common ransomware and worm entry point High

Any High finding caps your exposure grade at D

How to confirm it

Check from outside your network. A free FreshScanSentry Basic Scan of your public IP address tells you whether port 445 answers.
Or use Nmap from another connection, such as a phone hotspot:
```
nmap -p 445 --script smb-protocols,smb-vuln-ms17-010 your-public-ip
```
smb-protocols lists the SMB versions offered. If it shows NT LM 0.12 (SMBv1), the old, dangerous version is turned on. smb-vuln-ms17-010 reports VULNERABLE if the machine is missing the WannaCry patch, which makes it an emergency.
Find the device. In your router, look for a port forward for 445 or a DMZ setting. In the cloud, look for an inbound rule allowing 445 from 0.0.0.0/0 or "Any".

Only scan addresses you own or have written permission to test. If the address belongs to a cloud file service such as Azure Files, port 445 is open by design. Restrict it to your own IP addresses or use a private endpoint.

How to fix it

1. Block port 445 from the internet

Router or firewall: delete any port forward for 445 (and 137–139, the older NetBIOS ports). Turn off DMZ mode if it's on.
Cloud: remove the inbound rule allowing 445 from anywhere. Allow it only from inside your private network, if at all.
NAS: in its settings, turn off any option that exposes SMB to the internet, and use the vendor's remote-access app or a VPN instead.

This one step removes the risk from the internet. The rest is defense in depth.

2. Give remote users a safer way in

VPN: staff connect to the office VPN first, then use mapped drives as normal.
Cloud files: move shared folders to OneDrive, SharePoint, Google Drive or Dropbox, which are built for access from anywhere.

3. Turn off SMBv1

On Windows, check and disable it in PowerShell as an administrator:

# Is SMBv1 on?
Get-SmbServerConfiguration | Select-Object EnableSMB1Protocol

# Turn it off
Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol

On a NAS, look for a "minimum SMB protocol" setting and choose SMB2 or SMB3. On Samba, set server min protocol = SMB2 in smb.conf.

If an old copier, scanner or other device stops saving to a shared folder after this, that device only speaks SMBv1. Update its firmware or replace it rather than turning SMBv1 back on.

4. Patch and tighten logins

Install Windows updates, and replace systems that no longer get them (Windows 7, Server 2008 and older).
Set an account lockout policy and use long, unique passwords for accounts that can open file shares.
Remove "Everyone" permissions from shared folders. Give access only to the people who need it.
On Samba, limit who can connect with hosts allow = 192.168.1.0/24 (your office network) in smb.conf.

5. Re-scan to confirm

Run another external scan. Port 445 should no longer appear, and your exposure grade should go up.

If you think someone already got in

Warning signs include files renamed with strange extensions, ransom notes in shared folders, unknown accounts, or antivirus that has been turned off. Disconnect affected machines from the network straight away, don't pay without advice, and contact an incident response provider. Restore from backups stored somewhere the attacker couldn't reach.

Common questions

Our internet provider blocks port 445. Do we still need to worry?

Many home internet providers block 445, but many business connections don't. If our external scan found it open, it's reachable, whatever the provider's policy.

Is SMB over the internet ever OK?

Only for services designed for it, such as Azure Files, which requires SMB3 encryption, and even then it's best limited to known IP addresses. An office server or NAS should never be reachable on 445 from the internet.

What about ports 137, 138 and 139?

These are NetBIOS, the older companion to SMB. They should be blocked from the internet too.

Sources: Microsoft MS17-010 · Microsoft: detect and disable SMBv1 · NVD: CVE-2017-0144 (EternalBlue) · NVD: CVE-2020-0796 (SMBGhost) · CISA: SMB security best practices · Nmap smb-protocols