Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Windows Server 2008 R2 SP1, running the Edge role of Lync Server 2010.

One internal network interface connected to the company LAN, configured with a private IP address, subnet mask, internal DNS servers and no default gateway.

One external interface connected to the Internet, configured with three public IP addresses, subnet mask, no DNS servers and a default gateway.

No other firewalls between the server and everything else, so I need to protect it using Windows Firewall.

What I want:

  • No protection on the internal interface, the server should be able to freely communicate with the internal network.
  • Full protection on the external interface, only the bare minimum ports and protocols required for Lync should be opened.

How do I configure Windows Firewall for this?

The server is configured to treat the external network as "public", but the internal one is automatically classified as "unknown", because that interface doesn't have a default gateway (and it shouldn't have one, routing should only happen on the outside interface); so it is treated as "public" too, and this can not be changed.

Windows Firewall is currently turned off on all network profiles; it shows that the server is connected only to "public" networks, not "private" or "domain" ones.


Update:

Using Chris S's suggestion, I was able to configure the internal network as "private" and the external network as "public"; then I turned on Windows Firewall, configured the private profile to allow all traffic, and left the public one as default (block all except exceptions).

But I'm still able to RDP/SMB/RPC into this server from its public IP address... what's wrong here?

share|improve this question
    
The server must not be in the domain then? –  Chris S Nov 10 '11 at 13:44
    
No, Lync Edge servers must not be domain joined. –  Massimo Nov 10 '11 at 13:51

1 Answer 1

up vote 1 down vote accepted
  1. Start --> run --> gpedit.msc
  2. Browse: Computer configration --> Windows Settings --> Security Settings --> Network List Manager Policies --> Unidentified Networks
  3. Change 'Location type' to: Private, click 'Ok'.

Barrowed from Multiple NIC, Configure Windows Advanced Firewall

share|improve this answer
    
Great, this allows the inside network to be clasified as "private". –  Massimo Nov 10 '11 at 14:45
    
To the update: You've got me, I've never had that problem in Server 2008R2 (just in older 2008 installs, where it was a known problem). –  Chris S Nov 10 '11 at 16:22

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.