Close port 445

[criminala]

With the current exploit (CVSS 9.8 pre-auth RCE bug) in full swing , I would like to block port 445 towards the internet as many recommend .

I would like to doublecheck if I am doing the right thing here :

​

Firewall - Network services filter
Enable filter , deny list

And then in which field(s) do I exactly enter port 445 ? The first port range or the second , or both ?

​

Source IP	Port Range	Destination IP	Port Range	Protocol	Add / Delete

Protocol is TCP .

So what I have now is 2 rules , 1 with 445 in first port range column and 1 with 445 in the second port range column .
In source and destination IP , nothing needs to be filled in as far as I know , right ?

 

[ColinTaylor]

What's the CVE number? "CVSS 9.8" is just a score.

Can you post a link to the recommendations you're referring to?

 

[AndreiV]

What's the CVE number? "CVSS 9.8" is just a score.

Can you post a link to the recommendations you're referring to?

Critical Microsoft Outlook/365 bug CVE-2023-23397 under attack

A critical vulnerability in Microsoft Outlook/365 applications suite, CVE-2023-23397, takes an unopened email to exploit.

thestack.technology

Microsoft and Fortinet fix bugs under active exploit

The outlook is grim for Outlook - and SAP, Adobe. Android, and Chrome - so get ready for a long update party

www.theregister.com

 

[ColinTaylor]

Thanks @AndreiV

So to answer the OP's question:


This of course doesn't block the port if you're using a VPN client, on the router or on your PC.

 

[DJones]

Thanks @AndreiV

So to answer the OP's question:
View attachment 48533

This of course doesn't block the port if you're using a VPN client, on the router or on your PC.

Is this blocking ipv6 only. Because ipv4 firewall doesn’t let you block without a source ip.

 

[ColinTaylor]

Is this blocking ipv6 only. Because ipv4 firewall doesn’t let you block without a source ip.

No, that's IPv4. It's the Network Services Filter, not the IPv6 Firewall.

 

[DJones]

No, that's IPv4. It's the Network Services Filter, not the IPv6 Firewall.

Sry missed that.

 

[PunchCardBoss]

I would like to block port 445 towards the internet as many recommend

Isn't port 445 used for SMB (https://www.varonis.com/blog/smb-port). Careful.

 

[DJones]

Isn't port 445 used for SMB (https://www.varonis.com/blog/smb-port). Careful.

It filters LAN-WAN meaning it would block SMB over the internet. LAN to LAN should be fine. (correct me if mistaken)

 

[ColinTaylor]

It filters LAN-WAN meaning it would block SMB over the internet. LAN to LAN should be fine. (correct me if mistaken)

Correct.

 

[PunchCardBoss]

It filters LAN-WAN meaning it would block SMB over the internet. LAN to LAN should be fine. (correct me if mistaken)

I think the image shows 445 in the "destination" port field, not the "source" port field.

If I'm not mistaken, this would mean...

ANY "source" LAN or WAN IP with ANY port is allowed.
ANY "destination" LAN or WAN IP with port 445 ONLY will be DENIED.

 

[DJones]

I think the image shows 445 in the "destination" port field, not the "source" port field.

View attachment 48548

If I'm not mistaken, this would mean...

ANY "source" LAN or WAN IP with ANY port is allowed.
ANY "destination" LAN or WAN IP with port 445 ONLY will be DENIED.

Put it under port range.

If you specify just the port range it will limit all devices on LAN from accessing 445 over WAN. 445 isn’t a open port normally unless you port forward meaning the firewall should block incoming on 445 always except when a device on LAN makes a outbound connection on 445 from inside your LAN.

If you want specific devices blocked then add a source ip and destination.

 

[PunchCardBoss]

Put it under port range.

There is a "source" AND "destination" port range. Again, please correct me if I am wrong, but I had always understood that the "source" IP and port range refers to communication packets coming INTO the router and "destination" IP and port range refers to communication packets going OUT of the router.

If my understanding is correct, the 445 port in the "destination" port range will block ALL router outbound communication packets with a 445 port number regardless of LAN or WAN.

Then, if the purpose of the filter is to BLOCK any inbound packets on port 445, then the filter should look like this...

But, this will also block LAN to LAN packets on port 445.

Please correct me if my understanding is wrong.

 

[ColinTaylor]

If my understanding is correct, the 445 port in the "destination" port range will block ALL router outbound communication packets with a 445 port number regardless of LAN or WAN.

As noted above the Network Services Filter only affects traffic from the LAN (source) to the WAN (destination). Nothing else.

 

[DJones]

There is a "source" AND "destination" port range. Again, please correct me if I am wrong, but I had always understood that the "source" IP and port range refers to communication packets coming INTO the router and "destination" IP and port range refers to communication packets going OUT of the router.

If my understanding is correct, the 445 port in the "destination" port range will block ALL router outbound communication packets with a 445 port number regardless of LAN or WAN.

Source can be internal LAN ip’s as well. Because lan ip’s operate on a private range of addresses. Wan ip address’s won’t work as source (as far as I know) under network filter.

 

[PunchCardBoss]

Wan ip address’s won’t work as source (as far as I know) under network filter.

When I look at this example: https://www.asus.com/support/FAQ/1013636/, it looks like the "source" was a WAN IP.

Still learning - thanks to all.

 

[DJones]

When I look at this example: https://www.asus.com/support/FAQ/1013636/, it looks like the "source" was a WAN IP.

Still learning - thanks to all.

As far as ipv4 goes these 3 classes are private ip ranges not routed to the wider internet. Ip addresses outside of this range would be routable to the internet.

“For example, if you do not want the device to use the Internet service, key in 80 in the destination port. The traffic that uses port 80 will be blocked.

Leave the source IP field blank to apply this rule to all LAN devices.”

Source is meant for LAN device in this aspect. If we were talking about a firewall for wider WAN then yes it could be that source would deal with WAN ip addresses as well.

 

[bennor]

When I look at this example: https://www.asus.com/support/FAQ/1013636/, it looks like the "source" was a WAN IP.

Still learning - thanks to all.

The source (8.8.8.4) in that example is an actual IP address on the internet for Google apparently. It is not the router's WAN IP.

 

[PunchCardBoss]

@bennor , @DJones and @ColinTaylor

Tks for your explanations and patience. I need to review your posts a few more times to wrap my head around your info.

 

[DJones]

The source (8.8.8.4) in that example is an actual IP address on the internet for Google apparently. It is not the router's WAN IP.

Thought I was missing something in this discussion. (Yay ad blocker removing pictures)

I see your confusion.