Which services should never be exposed to the internet?

Remote desktop (RDP), file sharing (SMB), database ports, the management interfaces of firewalls, switches, printers and hypervisors, and industrial protocols such as Modbus or S7 should not be reachable from the internet. Put what staff need from outside behind a VPN or a gateway with multi-factor authentication, and keep the rest internal. Check regularly with an external scan of your own address ranges, after every firewall or router change, and switch off automatic port opening (UPnP) on routers. Cloud servers count too: their security groups open ports as easily as an office firewall does. NetSenX sees inbound connections to monitored hosts, on every plan, so a service that unexpectedly answers outside connections, or a host being scanned or hit by repeated logins, shows up in its traffic. It does not scan your public addresses.

← All 40 questions on Remote work and exposed servicesAll topics