Technical Anshu
Tutorials Blog
🌐 LAN Only Boundary

Share a Folder on Your Office LAN Only Never on the Internet

Windows file sharing was designed for a trusted room full of your own PCs. The moment a folder share becomes reachable from the internet, it faces automated attacks within minutes. This page keeps your shares exactly where they belong — inside your LAN — and shows the one safe way to reach them from outside.

✍️ Technical Anshu🪟 Windows 10 / 11⏱️ 7 minute read
🎥 Full video — sharing boundaries and safe remote access

Somewhere in every “how do I open my office files from home” search sits a dangerous suggestion: forward port 445 on the router to the office PC. It genuinely works — and it is one of the most reliably catastrophic things you can do to a small network. Internet-wide scanners probe port 445 constantly; an exposed Windows share is attacked by bots, not people, and the entry is often ransomware. Here is the boundary, drawn properly.

Windows Defender Firewall — File and Printer Sharing Rule (example)
Rule applies to profilePrivate only
Remote IP scopeLocal subnet SAFE
Router port forwarding for 445None — never DANGER
✔ Inside the LAN: shares work normally for office PCs
✔ From the internet: the share does not exist — exactly as intended
Example firewall scope. The router and the firewall are two separate walls; both should say LAN only.
1

Why Port 445 Must Never Face the Internet

Port 445 carries SMB, the Windows sharing protocol. It was built for trusted local networks: its historic vulnerabilities (the one WannaCry used) were devastating precisely when machines were exposed. Even fully patched, an internet-facing share invites nonstop password-guessing against your office accounts, and one weak password ends the story. There is no "careful" way to forward 445 — the correct number of internet-facing SMB shares is zero.

2

Check Your Router — Kill Any Forward and UPnP Surprises

  1. Log in to the router and open the Port Forwarding / Virtual Servers page
  2. There must be no rule forwarding 445 (or 139) to any PC. Delete any you find — including ones a "technician" added years ago
  3. Check UPnP: some software asks the router to open ports automatically. If you do not specifically need UPnP, turn it off, and re-check this page afterwards
  4. While you are here, confirm the router's own admin page is not exposed to the internet ("Remote management" off)
3

Scope the Windows Firewall Rule to the Local Subnet

  1. Open wf.msc (Windows Defender Firewall with Advanced Security) → Inbound Rules
  2. Find the enabled File and Printer Sharing (SMB-In) rules and confirm they are enabled on the Private profile only — never Public
  3. Open a rule's Properties → Scope tab → set Remote IP address to Local subnet
  4. Also confirm your office network is classified Private, not Public, in Settings → Network — on Public, sharing is (correctly) locked down and will simply refuse to work
4

The Safe Way In From Outside — a VPN, Not a Port

When someone genuinely needs office files from home, the answer is a VPN: the home PC joins the office network through an encrypted tunnel, and then uses the shares exactly as if it were sitting in the office — the share itself never touches the internet. Options range from the VPN server built into many office routers, to mesh tools like Tailscale that need no port forwarding at all (and are how this channel's no-static-IP setup works). The pattern to remember: the tunnel faces the internet; the share never does.

🔴 A quick self-test: from your phone with Wi-Fi off, try opening your office share by the office's public IP. It must fail completely. If it connects, something — a router forward, UPnP, a mis-scoped rule — has opened a door, and closing it is today's job, not this week's.

🎥 Watch the Full Video

The video covers the sharing setup this boundary protects — and the channel's Tailscale guide shows the VPN route for reaching office PCs from anywhere.

▶️ Watch Full Video
❓ Common Questions (FAQ)

Our technician forwarded the port years ago and nothing happened. Should I still remove it?

Yes. Exposure is a lottery you play every day: scanners retry endlessly, and “nothing happened” only means no attempt has succeeded yet. The forward gives you nothing a VPN does not do more safely — remove it.

Is sharing safe on my office LAN if the Wi-Fi password is shared with visitors?

That is a different weak wall: anyone on the Wi-Fi is “inside” your LAN. Give visitors a guest Wi-Fi network (most routers offer one, isolated from the LAN) and keep the office network's password for office devices only.

Can I share one folder to the internet with a very strong password?

Strength of password is not the main problem — protocol exposure is. SMB announces itself, gets probed for vulnerabilities, and a single Windows bug turns your strong password into a decoration. Use a VPN; it exists precisely for this job.

This guide is based on the Technical Anshu advanced sharing video • Stuck on any step? Ask in the video comments — you will get a reply there 🙏