Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Windows default firewall setting on the Domain controller seems to be opening a number of ports to 'any' type of connection. All I want open to the internet is the RDP port.

Can and should I manually restrict each of the inbound rules to allow the scope to be only 'local subnet'? is there a simpler way to do this?

share|improve this question
    
How is your network layed out? –  Massimo Feb 14 '10 at 13:02
    
Ok, I'll try restating. HOW IS YOUR NETWORK LAYED OUT? Do you have a local subnet? Do you have domain member computer which need to talk to this DC? Do you have a gateway, a firewall, something you can use? Does this DC have a public IP address? What about other computers? Please, try to provide more informations here. –  Massimo Feb 14 '10 at 17:44
    
On cloud hosting. 3 servers, 1 webservrr,1 databases,1 dc. All have rdp but I only have port 80 open on webservrr. Each computer has 2 nics, one dchp public and 1 for private network. –  zsharp Feb 15 '10 at 2:11
    
Oh my God, WHY?!? –  Massimo Feb 15 '10 at 6:10

4 Answers 4

up vote 1 down vote accepted

A domain controller needs to be quite opened in order to provide its services to your network; it just shouldn't be directly connected to the Internet.


Edit

Ok, let's see what you can do here.

Running things like you're doing now is definitely a source for troubles, you should avoid it at all costs.

You have two solutions:

  • Remove the "private" NIC from all servers, use only the public IP address on them (but use a static one, not DHCP!) and configure the firewall on each of them to only allow connections between them and from where you'll be RDPing into them.
  • Remove the "public" NIC from them, effectively putting them in a private LAN, and add another computer running Windows RRAS or ISA Server (or FFTMG, or Linux, or whatever else you want) with two network cards, one public and one private, acting as a firewall for your network.

Whatever you do, don't stay with two NICs and public/private IP Addresses at the same time on all your computers. This way, you get the troubles of both solutions plus multihoming, and the benefits of none.

share|improve this answer
    
See comment above –  zsharp Feb 14 '10 at 16:58
    
Why is it a problem if no external ports (except rdp)are open? Isn't that the point of a firewall? –  zsharp Feb 16 '10 at 17:59
    
The problem is having two IP addresses on each server. This totally screws up your networking in a domain environment. –  Massimo Feb 16 '10 at 18:47

If you're using Windows Firewall (or any other type of software firewall running on the machine itself) to protect your boxes from the internet then you're doing something wrong. Firstly it implies that each of your boxes has a direct connection to the internet, and secondly it puts you in a situation where you have multiple firewalls to configure and manage.

You need to get a proper firewall appliance in and configure your routing so that all internet access goes through it. Giving yourself a single point of access to or from the internet is a basic security requirement. This needn't be complex or expensive and will help you sleep easier at night.

share|improve this answer
    
Problem is Iam on a hosted cloud service so I have to use rdp to connect to each server –  zsharp Feb 14 '10 at 16:56

Try Windows Firewall with Advanced Security, which allows you to do more than the 'consumer-friendly' control panel UI.

You might also consider a third party firewall provider.

share|improve this answer

Try the following link:

Service overview and network port requirements for the Windows Server system http://support.microsoft.com/kb/832017

Hopefully this will help.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.