Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If I use Windows Server as a host OS, what are my options for firewall/AV?


share|improve this question
A few more details will help. Is this for a home network or business application? Do you have any budget in mind? What are the threats that you want to address? – William Feb 28 '10 at 21:12
Are you interested in hardware, software or both? You really do need to give us at least some clues. – John Gardeniers Feb 28 '10 at 21:47
This is a home network. 1 physical box with SCVMM for VMs (planned). – dotnetdev Mar 1 '10 at 23:52

Without knowing how your network is designed and implemented, it's a tad difficult to make a targeted suggestion. That being said, the Microsoft stack has a pretty well-established product for software Firewall (and some newly added client AV solutions, as well) in the Forefront Security Suite.

This link has details on the full suite of Forefront products -

There are plenty of other options, of course, and I'm not suggesting this is the best one (that would be hard to do given how little I know about your network), but the firewall component is based on MS ISA Server, a product that has been around for around a decade and is pretty robust.

If you're just trying to secure the host os, and not running an edge firewall service for your network, the default firewall that ships with Windows Server 2008 is enabled by default and, I've found, generally pretty well suited to standard host protection. It lacks some features of the full TMG suite, but it is generally good enough that I would not replace it with something third-party. In fact, if you do wind up using the Forefront TMG system, it will work with the built-in Windows Firewall / ICS Service to do basic packet filtering / stateful packet inspection tasks.

There is also firewall functionality included with most major Anti-Virus Vendor's Security Suites. I run the AVG Suite at home, and it includes a real time SPI firewall in addition to the malware, and anti-virus stuff. CA, Kapersky, McAfee and Symantec have similar offerings, but they tend to get expensive when purchasing for use on Server edition Operating Systems.

share|improve this answer
Quick note to Zephyr - I was indicating that the Forefront TMG system, which is based on the ISA Server product (available since about 2000) is fairly well established as edge / perimeter firewall product. This is not the Windows Firewall component that is based on Internet Connection Sharing, as you mention in your answer below. It's a separate product that has been in production use for over a decade as is farily well established as a competitor in the windows software firewall space, along with Checkpoint and a few others. – Bryan 'BJ' Hoffpauir Mar 1 '10 at 20:52

I disagree with the assertion that Windows Firewall is well established.

I won't contest that its certainly improved, theres many longstanding issues present.

[In Microsoft's Defense, Many of the generic issues like filtering outbound traffic and some of the truly heinous flaws (Such as the LanMAN attack) have been mitigated to a certain extent]

Things like SYN-FIN ambiguity are STILL present in some regard depending on several factors. TTL manipulation (more popularly - Firewalking) has never STOPPED working. And with the brand spanking new ICMPv6 router advertisement bug, it was also found that the firewall was vulnerable to remote code execution using similar bad data in the ICMP header.

In short, I'd trust Microsoft's firewall for serious endpoint security just about as far as I can throw it.

It may be tough to buckle down and get an ASA or a Sonicwall, but I think you'll be glad you did when it blocks a clever attacker.

If you're adamant about the firewall being on the server, Kaspersky offers a decent endpoint solution, as does Symantec. If you still absolutely feel compelled to use the Windows firewall, be sure to disable as much of the Stateful functionality as possible (as counterintuitive as it may be) as that is where the majority of RCE flaws will inevitably show up.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.