Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Just booted into a newly provisioned windows server 2008 r2 server.

On the firewall side of things, it is disabled by default.

This is a web server, so I need at minimum port 80, rdp port left open.

The inbound/outbound panels have tons of rules already setup to 'allow' certain ports/protocols etc.

I export the rules to a file.

Would it be a good idea to delete all those rules, and then create the few rules I need from scratch? (when it is disabled, then enable when I think I am done)

One thing I am scared of is if I lock myself out of the server, any tips to ensure I don't?

share|improve this question

Is this server in a domain environment? If so, you probably want to leave a lot of those predefined rules in place. To start with, I suggest only adding Allow rules for your HTTP and RDP traffic, and leave the rest as defaults.

If you really want to tighten up the firewall as much as possible, you could do your testing on a server that is more accessible, and once you've proven the configuration then just copy that configuration to your production server.

When you're working on a remote system and you're worried about making a configuration change that could lock you out, it's a good idea to have something out-of-band that lets you recover. Examples:

  • A KVM over IP device so you can access the local console even with networking disabled
  • HP iLO or Dell DRAC management technology
  • Somebody you can call who has physical access to the server

If you don't have those available, you can usually set up some kind of failsafe. In your situation, try creating a scheduled task that runs netsh advfirewall reset. If you lock yourself out with a firewall rule, just wait until the scheduled task runs. Test your failsafe beforehand to ensure that you can rely on it.

share|improve this answer
no its not in a domain environment, just a web server. – Blankman Feb 8 '12 at 3:10

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.