For years, the only sane way to reach a file share from outside the office was a VPN. SMB ran on TCP port 445, and exposing 445 to the internet was a non-starter — it’s blocked by most ISPs and it’s a magnet for attacks. So remote file access meant connecting the VPN first, then mapping the drive.
SMB over QUIC changes that path. It wraps SMB traffic in the QUIC protocol over UDP 443 — the same port HTTPS uses — inside a TLS 1.3 tunnel. A Windows 11 client can open a share on a Windows Server 2025 file server across the open internet, encrypted end to end, without a VPN and without port 445 ever leaving the building. Microsoft describes it as a TLS 1.3 security tunnel for SMB, much like a VPN but scoped to file sharing.
This article covers what SMB over QUIC actually does, where it fits (and where it doesn’t), the requirements, and how to set it up.
What SMB over QUIC actually is
QUIC is a transport protocol built on UDP, originally from the web world, with TLS 1.3 baked into the protocol rather than bolted on. SMB over QUIC runs the normal SMB file-sharing protocol on top of that transport instead of on raw TCP.
Three things matter about that:
- UDP 443. The connection uses UDP port 443 by default. Firewalls and home routers already allow outbound 443, so a remote user usually doesn’t need any special network config to reach the server.
- TLS 1.3 everywhere. Every byte is encrypted by the transport itself, and the server is authenticated by certificate. There’s no unencrypted mode to misconfigure.
- Port 445 stays internal. Clients reach the server over QUIC; the legacy SMB-on-TCP-445 surface never has to be exposed to the internet.
When to use it — and when not to
SMB over QUIC solves a specific problem: secure file-share access from outside a trusted network. It’s a good fit when that’s what you actually need.
Reach for it when:
- Remote or travelling users need to open files on a head-office or edge file server without a full VPN.
- You want to retire VPN connections that exist purely to reach file shares.
- A branch or partner needs controlled access to specific shares over the internet.
Look elsewhere when:
- Users need access to many services, not just files — a VPN or a broader remote-access design still makes sense there.
- Your clients aren’t Windows 11 or your server isn’t a supported edition (see requirements below). SMB over QUIC is endpoint-specific; it won’t help a Windows 10 fleet.
- The file server already sits on the internal network that VPN users reach fine, and there’s no remote-access pain to solve.
Requirements
Both ends have to support it, and the server needs a certificate.
SMB over QUIC requirements
| Server OS | Windows Server 2025, or Windows Server 2022 Datacenter: Azure Edition |
|---|---|
| Client OS | Windows 11 |
| Certificate | A server TLS certificate whose subject/SAN matches the connection names |
| Port | UDP 443 reachable to the server (alternative ports configurable on WS2025) |
| Role | File Server role, managed via Windows Admin Center or PowerShell |
The certificate is the part people underestimate. QUIC’s TLS 1.3 tunnel authenticates the server, so the certificate’s subject or subject alternative name has to match every name clients use to connect — including the public name they resolve from outside. A certificate that only carries the internal hostname will fail when a remote client connects by its external FQDN.
Setting it up
The supported way to configure SMB over QUIC is through Windows Admin Center, which walks you through selecting the certificate and enabling QUIC on the file server. The high-level flow:
- Install or import the server’s TLS certificate into the computer’s Personal store, with the right subject/SAN names.
- In Windows Admin Center, open the file server, go to Files & file sharing > File shares > SMB over QUIC.
- Select the certificate and enable SMB over QUIC.
- Make sure UDP 443 is reachable to the server from where clients will connect, and that your public DNS resolves the chosen name to it.
From a Windows 11 client, you then connect using the server’s FQDN as normal — the client negotiates QUIC automatically when the server offers it. You can also confirm and inspect connections with the SMB PowerShell cmdlets:
# On the server: see SMB over QUIC configuration and connections
Get-SmbServerCertificateMapping
Get-SmbConnection | Select-Object ServerName, Transport, DialectThe Transport column shows QUIC for connections riding the QUIC tunnel, which is the quickest confirmation it’s actually working rather than quietly falling back to TCP internally.
On Windows Server 2025 specifically, you’re no longer locked to port 443. If 443/UDP is already taken on the host, you can configure alternative SMB ports for QUIC (and TCP), provided the server is set to listen on the chosen port and clients are told to use it.
Locking down who can connect
Exposing a file server to the internet, even over TLS 1.3, deserves a tight access list. SMB over QUIC supports client access control, which lets you build allowlists and blocklists so only approved devices can establish a QUIC connection to the server. That’s an extra gate on top of the usual share and NTFS permissions.
Configure it per server or per certificate mapping, naming the client devices you trust. The model is allow-by-list: you decide which clients may connect at the transport layer before authentication and share permissions even come into play.
SMB over QUIC deployment checklist
- Server runs Windows Server 2025 (or WS2022 Datacenter: Azure Edition)
- Clients run Windows 11
- A TLS certificate is installed with the correct subject/SAN for the public name
- Public DNS resolves the connection name to the server
- UDP 443 (or your chosen alternative port) reaches the server
- Client access control limits connections to approved devices
- The server is patched and QUIC connections are monitored
- Verified Transport = QUIC with Get-SmbConnection
How it compares to the old way
It helps to line SMB over QUIC up against the two things it competes with.
Remote file access options
| SMB over QUIC | TLS 1.3 over UDP 443, no VPN, file shares only. Needs WS2025/WS2022 Azure Edition + Win11 + certificate. |
|---|---|
| VPN + SMB | Full network access, works with any client/server, but every remote user needs the VPN client and connection up first. |
| SMB on TCP 445 exposed | Don't. Blocked by most ISPs, heavily attacked, and unencrypted by default on older dialects. |
If your clients and server qualify and the need is remote file access, SMB over QUIC is the cleaner option — fewer moving parts for the user and nothing risky exposed. If you’re supporting mixed or older clients, the VPN path remains the compatible choice until the fleet catches up. For background on SMB security generally, including signing and encryption that still apply over QUIC, our overview of SMB and file-server fundamentals and the Windows Server hardening checklist are worth pairing with this.
Wrapping up
SMB over QUIC is the answer to a question admins have asked for years: how do I let someone open a file share from outside without a VPN and without exposing port 445? It runs SMB inside a TLS 1.3 QUIC tunnel on UDP 443, authenticates the server by certificate, and lets you allowlist which clients connect. On Windows Server 2025 with Windows 11 clients, it’s a practical way to deliver secure remote file access.
It isn’t a universal VPN replacement, and it leans on getting the certificate names and client access control right. But for the specific job of reaching files securely over the internet, it’s the most direct option Windows has offered — provided both ends are new enough to speak it.
