Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Out of convenience, I have set the firewall rules of one of our customers' Windows 2008 R2 server so that it is open for all incoming traffic, all port and all programs, but the scope settings limit it to one specific remote IP address - ours. The reason is that we access the database and other programs remotely.

Question: is such a setting risky? Should I put effort into establishing separate rules for specific ports and programs in addition to our fixed IP address?

As a developer, I find it hard to estimate the danger of IP spoofing and whatever other hacking techniques there may be that can take advantage of that setup.

share|improve this question
add comment

3 Answers

up vote 5 down vote accepted

In general, the less attackable surface area, the better. You're are on the right track with constraining that down to a specific source IP. Following the least privilege principal, you should deny all destination ports and only open up the ones you actually need. You would then have to weigh the cost of administration against the risk. The risk is going to depend on several things such as how sensitive the data is you are accessing, if the server is compromised, what is the quantified loss, etc.

That being said, it is far more likely that an attacker will exploit a vulnerability on the customer's server from inside their own network than it would be for them to perform a man in the middle attack and nab your credentials, sensitive db material, etc. IP spoofing in practical application would not be much of a worry here. It is usually used to scan a network or to frame another machine/IP. It becomes extremely complicated to spoof an IP and do anything functional when using protocols that require a session to be setup between a source and destination. Possible, but not probable. (see arp or dns poisoning)

Another more likely attack vector (to the DB) could be that your own machine/network is compromised, and the attacker could pivot from there and hit the DB machine. Of course, at this point, you would have bigger problems. ;) Hope this helps a bit.

share|improve this answer
    
+1 for "weigh the cost of administration against the risk". I have a feeling that sometimes the cost is forgotten. Good to know that "IP spoofing in practical application would not be much of a worry here" - which basically answers the intention of my question. Thanks. –  Olaf Feb 20 '12 at 17:48
add comment

It is an unnecessary risk. Most database access could be handled by certificate authentication. 'Other programs' is too vague. Does this mean you need to authenticate with a remote windows computer over the Internet? Sounds like a VPN would be useful. Seems unlikely to me in this day and age that two organizations on the Internet would not have firewalls capable of establishing an IPSEC VPN connection between them.

share|improve this answer
    
Well it's rather a standard hosting scenario. The customers' server is a Virtual Machine rented on a monthly basis, used mainly for webhosting. And yes, we authenticate over the Internet. Mostly the access is through RDP, but "other programs" just means that we use FTP, VNC and so on as well. VPN could be set up, but I was wondering if restricting access to just one specific IP might be good enough. –  Olaf Feb 19 '12 at 16:29
    
If it's only a known set of applications, I would limit the access rule to those ports. Allowing all ports is dangerous. This would mitigate the risk for the scenario where if the machine on the incoming side were compromised, it may affect the remote machine with the permissive access rule for ports and applications that you did not intend. –  Greg Askew Feb 19 '12 at 17:44
add comment

Given your explanation of the scenario, I'd say restrict access to a single IP (the public IP address of your firewall), and manage who is allowed to reach the various server services through that public IP via your firewall rules.

As long as your IP address is static, you should be fine.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.