SMB trap for outbound (safeguard windows user info; cylance Spear report)

[Tikimotel]

I was watching the Techsnap show like I do almost every week.
http://www.jupiterbroadcasting.com/80632/smbtrapped-in-microsoft-techsnap-210/
The Spear white paper : http://cdn2.hubspot.net/hubfs/270968/SPEAR/RedirectToSMB_public_whitepaper.pdf?t=1429209774760

Did I block outgoing traffic correctly?

I made an Alias for the two mentioned TCP ports (139 & 445) and called this "SMBports"
On the WAN side I made a rule stating:
          ID  Proto        Source Port Destination Port         Gateway Queue Schedule Description
(block) IPv4+6 TCP LAN net * ! LAN net         SMBports *         none                 SMB Trap for outbound

Did I do it correctly, or should I only block IPv4?

[doktornotor]

I'm blocking this MS junk thoroughly on wifi, TCP+UDP, IPv4+IPv6.  :P

[themod]

Hi;
I tried to set this up via your screen shot.
what about destination in the rule?
I have it set to use the alias and to block but if I use the example here:https://doc.pfsense.org/index.php/Aliases.
but I didn't do the extra alias.
any help thank you.

[doktornotor]

Not really sure what's your concern with destination. LAN traffic does not go through the firewall.

[themod]

ok; i was setting it up wrong then
had it set on wan

[themod]

@doktornotor:

Not really sure what's your concern with destination. LAN traffic does not go through the firewall.

ok;
I'm still not getting it then. please give me a little lead way here  made the alias . then go to rules  then block  set single and then any ip's .
get this:
The following input errors were detected:

netbios_ports is not a valid source IP address or alias.
netbios_ports is not a valid destination IP address or alias.
what did i do wrong?

[doktornotor]

Uh. That was my example. Of course if your alias name does not match, you get errors. You cannot just copy things blindly. Please, think about what you are doing. ;)

[themod]

@doktornotor:

Uh. That was my example. Of course if your alias name does not match, you get errors. You cannot just copy things blindly. Please, think about what you are doing. ;)

Hi;
Yes I named it the same as what I saw in the screen shot. ports and all.
then went to rules and try to set it up to block.
same name as i had it ope in another window.