0

I'm working with a friend who is having an issue with failed RDP hacking attempts eating up bandwidth on his server. His server is a Windows Server 2008 R2 box which is directly connected to the internet, using only the Windows firewall and no hardware device.

The server is only connected to the internet publicly with no local LAN connected.

Our solution to the RDP problem was to create a local loopback adapter on the computer and assign it a static IP address, then, to install RRAS & assign VPN clients addresses from a static pool in the same subnet as the loopback adapter. From here, we would only allow RDP access through the RRAS interface, rather than from the public adapter.

The VPN is working properly, but now when it comes to disabling the firewall for RRAS-connected clients, I can't seem to get the firewall to actually stop on the RRAS or loopback interface.

I've attempted disabling the firewall within the Windows Firewall with Advanced Security console by selecting properties from the root of the node, and disable for both the RRAS & loopback adapters.

Any ideas would be greatly appreciated.

2 Answers 2

0

The firewall isn't active on the rras interface. RRAS is a (poor) firewall in of itself and applies itself to the interface which is facing the internet. All ports are automatically closed off. In the properties for the server there is a filter button where you can modify which ports are open to the world. You need to add a filter to allow the responses to outbound traffic to come back if you are going to permit this server to browse the net.

For the loopback interface you will need to assign it to a network - public, domain, etc. The network assignment affects which parts of the firewall policy apply to traffic coming in on it.

Your vpn traffic will be passing through the server and going to itself but the firewall rules will see that as traffic coming from your loopback network. The firewall needs to know which rules to apply and they are classified by type of network.

Ian

1
  • This kind of answered my question. I managed to get everything working by going into my RDP firewall rule (TCP-in) -> Scope -> Allow "Any IP address" on the local portion & ONLY the subnet of the loopback adapter (ex. 192.168.1.0/24) under the remote portion.
    – cjones26
    Apr 13, 2011 at 19:52
0

You could try setting up a GPO to disable Windows Firewall. Set the security filtering to only have it apply to users with the permissions to login to that server.

http://technet.microsoft.com/en-us/library/bb490626.aspx

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .