2

Windows Server 2008 R2 SP1, running the Edge role of Lync Server 2010.

One internal network interface connected to the company LAN, configured with a private IP address, subnet mask, internal DNS servers and no default gateway.

One external interface connected to the Internet, configured with three public IP addresses, subnet mask, no DNS servers and a default gateway.

No other firewalls between the server and everything else, so I need to protect it using Windows Firewall.

What I want:

  • No protection on the internal interface, the server should be able to freely communicate with the internal network.
  • Full protection on the external interface, only the bare minimum ports and protocols required for Lync should be opened.

How do I configure Windows Firewall for this?

The server is configured to treat the external network as "public", but the internal one is automatically classified as "unknown", because that interface doesn't have a default gateway (and it shouldn't have one, routing should only happen on the outside interface); so it is treated as "public" too, and this can not be changed.

Windows Firewall is currently turned off on all network profiles; it shows that the server is connected only to "public" networks, not "private" or "domain" ones.


Update:

Using Chris S's suggestion, I was able to configure the internal network as "private" and the external network as "public"; then I turned on Windows Firewall, configured the private profile to allow all traffic, and left the public one as default (block all except exceptions).

But I'm still able to RDP/SMB/RPC into this server from its public IP address... what's wrong here?

2
  • The server must not be in the domain then?
    – Chris S
    Nov 10, 2011 at 13:44
  • No, Lync Edge servers must not be domain joined.
    – Massimo
    Nov 10, 2011 at 13:51

1 Answer 1

1
  1. Start --> run --> gpedit.msc
  2. Browse: Computer configration --> Windows Settings --> Security Settings --> Network List Manager Policies --> Unidentified Networks
  3. Change 'Location type' to: Private, click 'Ok'.

Barrowed from Multiple NIC, Configure Windows Advanced Firewall

2
  • Great, this allows the inside network to be clasified as "private".
    – Massimo
    Nov 10, 2011 at 14:45
  • 1
    To the update: You've got me, I've never had that problem in Server 2008R2 (just in older 2008 installs, where it was a known problem).
    – Chris S
    Nov 10, 2011 at 16:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .