Blocking Outbound SMB Connections from Internal PCs — DrayTek Vigor2925 Case Study

Background

Recently, multiple internal workstations were found repeatedly initiating SMB (445 / 139 / NetBIOS) connections to various public IP addresses.

Because the company policy only allows internal SMB access to a designated NAS server, this activity was deemed abnormal and suggested potential malware infection or misbehavior.

In addition to the security concern, the excessive outbound SMB traffic also caused noticeable network performance degradation.
Users reported that many websites became slow to load or failed to open entirely.
Firewall inspection revealed that the abnormal SMB traffic was consuming significant bandwidth and disrupting WAN load-balancing behavior.

---

Investigation and Malware Removal

Upon detection, affected hosts were examined and scanned using Kaspersky Virus Removal Tool (KVRT). KVRT identified and removed multiple types of malware, including trojans and network worms. Many of these threats attempt propagation or scanning via SMB.

After cleaning infected machines with KVRT, suspicious outbound SMB traffic noticeably decreased. However, firewall-level controls were still implemented to prevent reemergence or propagation of undetected threats.

---

Objectives

1. Block outbound SMB traffic (ports 445 and 137–139) from a specific internal subnet to the Internet.
2. Maintain legitimate SMB access from internal hosts to the authorized internal NAS.
3. Avoid disrupting legitimate NAS services required by the organization.

---

Network Overview

• Router: DrayTek Vigor2925 (dual-WAN, load balancing)

• Internal hosts: a controlled internal subnet

• NAS: an authorized internal file server (internal-only SMB allowed)

• Logs: Firewall/syslog show outbound SMB attempts to multiple public IPs

• • *

Analysis

1. The router’s default behavior permitted LAN-to-WAN traffic, allowing infected hosts to reach external SMB endpoints.
2. Firewall logs showed numerous outbound SMB attempts and short-lived TCP state changes consistent with scanning or worm activity.
3. Endpoint cleanup reduces immediate threats, but network-level rules are required to prevent future lateral movement or new infections spreading externally.

---

Network-Layer Solution

Below is a conceptual workflow to implement via the DrayTek Vigor interface (map to your router GUI):

1. Define SMB service objects and a service group

Create service objects:

• TCP/UDP port 445 (SMB)
• TCP/UDP ports 137–139 (NetBIOS)

Group them into a single service group named SMB.

2. Create Data Filter Rules (order matters)

Add two rules in your Data Filter set, ensuring the Allow rule is above the Block rule:

• Allow rule (Access to NAS)
  • Direction: LAN → WAN
  • Source: the controlled internal subnet (affected hosts)
  • Destination: the authorized internal NAS (internal IP)
  • Service: SMB group
  • Action: Pass Immediately
• Block rule (Block other SMB)
  • Direction: LAN → WAN
  • Source: the controlled internal subnet
  • Destination: Any (external)
  • Service: SMB group
  • Action: Block Immediately

If IPv6 is in use, ensure equivalent rules are applied or IPv6 filtering is enabled.

3. Enable Data Filter

In the router’s firewall general settings, enable Data Filter and assign the filter set you created. Enable strict security options where applicable.

---

Verification Advice

Recommended checks (execute in a controlled environment):

• Examine firewall logs to verify the Block rule is triggered for external SMB attempts.

• Confirm internal access to the authorized NAS remains functional.

• On affected hosts, run netstat -ano (or equivalent) to identify any process holding outbound 445 connections and correlate PIDs to processes.

• • *

Additional Recommendations (endpoint and long-term)

1. Continue periodic endpoint scans with KVRT or enterprise-grade anti-malware solutions.
2. Implement outbound SMB blocking at the host firewall level as redundant protection.
3. Apply principle of least privilege to reduce the attack surface of file sharing.
4. Replace direct external SMB exposure with secure alternatives such as VPN or reverse proxy for remote NAS access.
5. Set up continuous monitoring, logging, and alerting to detect spikes in outbound SMB attempts.

---

Conclusion

Combining endpoint remediation (KVRT) with network-layer enforcement (DrayTek Data Filter) provides a layered defense that:

• Effectively blocks internal hosts from initiating unauthorized SMB connections to the Internet.
• Preserves legitimate SMB access to the designated internal NAS.
• Lowers risk of lateral movement and data exposure from compromised hosts.

This incident demonstrates a practical workflow: detect abnormal behavior, clean endpoints, enforce network restrictions, and maintain ongoing monitoring.