SMB trap for outbound (safeguard windows user info; cylance Spear report)

Tikimotel

I was watching the Techsnap show like I do almost every week.
http://www.jupiterbroadcasting.com/80632/smbtrapped-in-microsoft-techsnap-210/
The Spear white paper : http://cdn2.hubspot.net/hubfs/270968/SPEAR/RedirectToSMB_public_whitepaper.pdf?t=1429209774760

Did I block outgoing traffic correctly?

I made an Alias for the two mentioned TCP ports (139 & 445) and called this "SMBports"
On the WAN side I made a rule stating:
ID Proto Source Port Destination Port Gateway Queue Schedule Description
(block) IPv4+6 TCP LAN net * ! LAN net SMBports * none SMB Trap for outbound

Did I do it correctly, or should I only block IPv4?

doktornotor

I'm blocking this MS junk thoroughly on wifi, TCP+UDP, IPv4+IPv6. :P

themod

Hi;
I tried to set this up via your screen shot.
what about destination in the rule?
I have it set to use the alias and to block but if I use the example here:https://doc.pfsense.org/index.php/Aliases.
but I didn't do the extra alias.
any help thank you.

doktornotor

Not really sure what's your concern with destination. LAN traffic does not go through the firewall.

themod

ok; i was setting it up wrong then
had it set on wan

themod

@doktornotor:

Not really sure what's your concern with destination. LAN traffic does not go through the firewall.

ok;
I'm still not getting it then. please give me a little lead way here made the alias . then go to rules then block set single and then any ip's .
get this:
The following input errors were detected:

netbios_ports is not a valid source IP address or alias.
netbios_ports is not a valid destination IP address or alias.
what did i do wrong?

doktornotor

Uh. That was my example. Of course if your alias name does not match, you get errors. You cannot just copy things blindly. Please, think about what you are doing. ;)

themod

@doktornotor:

Uh. That was my example. Of course if your alias name does not match, you get errors. You cannot just copy things blindly. Please, think about what you are doing. ;)

Hi;
Yes I named it the same as what I saw in the screen shot. ports and all.
then went to rules and try to set it up to block.
same name as i had it ope in another window.