2

I recently was attacked by some cryptolocker (not sure if it's WannaCry) and now I am revising my network policies. For reaching this aim I want to disable all SMB-activity for infected PC. Surprisingly, even doing all according to guidelines, my SMB-traffic is not blocked anyway.

I blocked ports 137,138 (UDP) and 139, 445 (TCP) on router level (AsusWRT), but I still can access target PC shares. Why? The only measure that helped is stopping Server service on target PC. Here is my firewall rule table concerning these two machines.

enter image description here

I wanna highlight, this is white-list table, so it denotes only connections that are allowed between Server (i.e. SMB-server) and Client (i.e. SMB-client).

As you can see, those ports are allowed on client. Is it the reason that SMB traffic is flowing? Can we effectively block SMB only for one server, without affecting the client?

P.S. The server is Win8.1 Pro, the client is Win10 Pro Creators Update, both have 192.168.X.X addresses.

  • Do I understand it correctly that you blocked SMB ports on your router for access from outside your network but you wonder why you can access PC shares from inside your network? Or how did you check that access is possible? – Steffen Ullrich May 21 '17 at 11:48
  • But firewall rules apply to all packets moving throughout network, whether they arrived from outside network, or cross within LAN. Firewall log says so. – Suncatcher May 21 '17 at 12:05
2

Most consumer routers have a single port that goes to the WAN and Four (or other) ports dedicated to the LAN. In the case of the AsusWRT it appears as though those four ports are switched and not routed, and therefore operate at layer 2 of the OSI model.

As the traffic between the WAN port and the LAN ports is routed, traditional firewalling is possible as this is occurring at layer 3. Traffic that originates on your LAN, and is destined for another computer on the LAN (and visa versa) does not travel through the firewall. It is therefore not possible to do what you're hoping to do at the network level and this firewalling should be done at the host level.

I see your comment stating that the logs say that all traffic is passing through the firewall, so I'd love to see those logs if you could amend your question but I highly doubt that your router is capable of layer 3 firewalling on those switch ports.

  • Do such devices, allowing to firewall internal LAN traffic, exist at all or endpoint filtering is the only way? – Suncatcher May 21 '17 at 14:17
  • Yeah, I think you are right. I re-inspected the logs and see they describe only LAN-to-WAN connections. Also telnet says ports are still open. – Suncatcher May 21 '17 at 14:23
  • 1
    @Suncatcher You can configure PVLANs (or similar methodology), but as best I know you'd need an enterprise grade device to do that. You could get something like MikroTik which is an inexpensive option with enterprise features, though some people with less networking experience will likely have a bit of a learning curve. – DKNUCKLES May 21 '17 at 14:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.