# Which services should never be exposed to the internet?

Remote desktop (RDP), file sharing (SMB), database ports, the management interfaces of firewalls, switches, printers and hypervisors, and industrial protocols such as Modbus or S7 should not be reachable from the internet. Put what staff need from outside behind a VPN or a gateway with multi-factor authentication, and keep the rest internal. Check regularly with an external scan of your own address ranges, after every firewall or router change, and switch off automatic port opening (UPnP) on routers. Cloud servers count too: their security groups open ports as easily as an office firewall does. NetSenX sees inbound connections to monitored hosts, on every plan, so a service that unexpectedly answers outside connections, or a host being scanned or hit by repeated logins, shows up in its traffic. It does not scan your public addresses.

FAQ: [Remote work and exposed services](https://netsenx.com/en/faq/remote) · https://netsenx.com/en/faq/which-services-should-never-be-exposed-to-the-internet

## Read next

- https://netsenx.com/en/is-someone-inside-your-network
- https://netsenx.com/en/encrypted-traffic-analysis

## Related questions

- [How does remote working increase cyber-security risk?](https://netsenx.com/en/faq/how-does-remote-work-increase-cyber-risk)
- [How do I secure remote workers who access the company network?](https://netsenx.com/en/faq/how-to-secure-remote-workers-accessing-the-company-network)
- [Do we need a VPN for remote work?](https://netsenx.com/en/faq/do-we-need-a-vpn-for-remote-work)
- [Is a VPN protected only by a password enough?](https://netsenx.com/en/faq/is-a-vpn-without-multi-factor-authentication-enough)
- [Why are unpatched VPN gateways such a risk?](https://netsenx.com/en/faq/why-are-unpatched-vpn-gateways-a-risk)