Port 445: SMB file sharing
What it is, why it matters and how to restrict it.
The port of SMB, used by Windows file sharing and Samba. Exposing it to the internet is a long-standing cause of worm and ransomware incidents.
Secure it
Block it at the network edge and on the host, and share files over a VPN or another protocol instead. On Samba, use the hosts allow option as an additional safeguard.
Allow only one address on Linux
sudo iptables -I INPUT 1 -p tcp --dport 445 -j DROP sudo iptables -I INPUT 1 -p tcp -s 203.0.113.5 --dport 445 -j ACCEPT
The drop rule goes in first and the allow rule is inserted above it, so 203.0.113.5 is matched first. Replace it with your own address. With ufw, the equivalent allow rule is:
sudo ufw allow from 203.0.113.5 to any port 445 proto tcp
Check from outside
nc -vz SERVER_IP 445
Run it from an allowed address and from another one. A connection should succeed from the first and fail or time out from the second. Build custom rules with allow a port from specific IPs, or see all common ports.
FAQ
What is port 445 used for?
Port 445 is the default TCP port of SMB file sharing.
Should port 445 be open to the internet?
Usually not. Keep it on localhost, behind a VPN, or limited to specific source IPs.
How do I block port 445 for everyone except one IP?
Add an ACCEPT rule for that address, then a DROP rule for the port below it. The commands above do this in the correct order.