Port reference
Port 445 (TCP) – SMB / CIFS
Server Message Block — Windows file/printer sharing and the primary AD lateral-movement channel.
Quick facts
- Transport
- tcp
- Category
- Well-known
- Risk level
- Critical
Actively exploited and high-impact — keep it off the public internet.
Default state
Open on virtually all Windows hosts and domain controllers. Frequently and dangerously exposed to the internet.
What is port 445 used for?
Port 445 runs SMB (Server Message Block), also called CIFS, the protocol Windows uses to share files and printers across a network. It is what powers Windows network drives, shared folders, and "\\server\share" paths, and it is also handled by Samba on Linux and macOS. Since Windows 2000 it runs directly over TCP, replacing the older NetBIOS setup on port 139.
When would you open it?
You would open port 445 on an internal network so computers can reach a shared file server or network printer. It belongs on a trusted LAN, not the open internet. Only allow it between machines that genuinely need to share files, and reach remote shares through a VPN.
Is it safe to open?
Exposing 445 to the internet is dangerous and a major ransomware target, so keep it strictly internal and behind a VPN. See the security notes below.
How to check if this port is open
ss -tulpn | grep :445
nmap -p 445 <target>netstat -ano | findstr :445
Test-NetConnection <host> -Port 445lsof -i :445
nmap -p 445 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 445 to your device's local IP, internal port 445, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 445/tcpsudo firewall-cmd --permanent --add-port=445/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 445 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 445" -Direction Inbound -Protocol TCP -LocalPort 445 -Action AllowSecurity & risks
Common attacks
- EternalBlue / MS17-010 pre-auth RCE (CVE-2017-0144)
- SMB relay (NTLM relay to SMB/LDAP)
- Null-session and share enumeration
- Ransomware lateral movement and encryption over shares
Hardening
- Disable SMBv1; require SMBv3 with encryption
- Enforce SMB signing to defeat relay attacks
- Never expose 445 to the internet
- Restrict anonymous/null access and apply least-privilege share ACLs
- Patch MS17-010 and SMBGhost (CVE-2020-0796) promptly
How to block this port
sudo ufw deny 445/tcpsudo firewall-cmd --permanent --remove-port=445/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 445 -j DROPNew-NetFirewallRule -DisplayName "Block 445" -Direction Inbound -Protocol TCP -LocalPort 445 -Action Blocknmap snippet
nmap -p445 --script smb-vuln-ms17-010,smb-enum-shares,smb-os-discovery <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- Is it safe to expose port 445 to the internet?
- No. Internet-exposed SMB is a top ransomware and worm vector — EternalBlue spread this way. Keep 445 internal only, behind a VPN, with SMBv1 disabled.
- What is EternalBlue?
- EternalBlue (MS17-010 / CVE-2017-0144) is a wormable SMBv1 pre-auth RCE used by WannaCry and NotPetya to spread across networks via port 445.