I recently was attacked by some cryptolocker (not sure if it's WannaCry) and now I am revising my network policies. For reaching this aim I want to disable all SMB-activity for infected PC. Surprisingly, even doing all according to guidelines, my SMB-traffic is not blocked anyway.
I blocked ports 137,138 (UDP) and 139, 445 (TCP) on router level (AsusWRT), but I still can access target PC shares. Why? The only measure that helped is stopping Server service on target PC. Here is my firewall rule table concerning these two machines.
I wanna highlight, this is white-list table, so it denotes only connections that are allowed between Server (i.e. SMB-server) and Client (i.e. SMB-client).
As you can see, those ports are allowed on client. Is it the reason that SMB traffic is flowing? Can we effectively block SMB only for one server, without affecting the client?
P.S. The server is Win8.1 Pro, the client is Win10 Pro Creators Update, both have 192.168.X.X addresses.