Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am using Hyper-V with Server 2008 R2. Does anyone know how to setup Windows Firewall so that I can restrict my Hyper-V guest instances to only allow outgoing connections on normal HTTP/HTTPS ports? This means it can browse web sites, but can't connect to FTP/SMTP/AIM.

I tried adding an outbound rule but not sure what programs I have to add, and also, the port section was disabled.


It appears what I am looking to do, cannot be done. Thank you all for the help.

share|improve this question
1  
Please define Hyper-V Terminal. I can not make sense of your question like that - the "Connection" windows show another computer, ever open http/https themselves, so a firewall would be useless. And Hyper-V is no terminal server. –  TomTom May 31 '12 at 18:18
    
Hyper-V Manager is a program, like parallel workstation or vmware that allows you to run virtual machines (instances of another OS). So i may have 5 windows XP virtual machines running on my server. I want to make sure this virtual machine cannot access anything but HTTP/HTTPS and i need to do it at the server level. i can't trust setting the windows firewall up on the virtual machine won't be modified. –  Anthony Greco May 31 '12 at 18:25
    
I am asking this because a virtual machine picked up malware that then allowed it to start port scanning. This malware was able to disable windows firewall and I cannot trust my antivirus will always pick it up. Thus I want to restrict it in the Server 2008 firewall so my Virtual Machine can never access anything besides the ports I care to allow it to use. –  Anthony Greco May 31 '12 at 18:27
1  
Hyper-V does not run within Windows. I know it looks like that from the Host OS, but it's not the case. Hyper-V is a bare metal hypervisor. The Firewall on the Host OS has nothing to do with Hyper-V and nothing to do with the Guest OSes. The Host OS itself runs in a special kind of Virtual Machine, not on the hardware. Knowing that should immediately clear up any questions about using the Host OSes Firewall to do anything to the Guest OSes connections. –  Chris S May 31 '12 at 19:15
1  
Spin up a third VM, install Linux and build yourself a firewall. Adjust the networking so the all access to the off the box, must pass through the firewall VM. –  Zoredache May 31 '12 at 19:15
add comment

2 Answers

up vote 5 down vote accepted

Take Hyper-V out of the question and the answer becomes obvious. Configure Windows Firewall on the guest (or a hardware firewall between the clients and the server) to allow only those ports. Configuring this has nothing to do with Hyper-V.

share|improve this answer
4  
@AnthonyGreco I believe MDMarra was clear: he said "configure Windows Firewall on the guest," not the host. –  Skyhawk May 31 '12 at 18:45
3  
You clearly don't have even a fundamental understanding of how Hyper-V or bridged networking works. You might be better off hiring someone with experience to configure this for you. You don't configure firewall rules for the guests on the host. You configure them on each individual guest. If this isn't working correctly, then it's probably because you're doing it wrong. You can't make a rule on the Hyper-V host that says "no guests can do anything except HTTP". –  MDMarra May 31 '12 at 18:53
2  
@AnthonyGreco Hyper-V (the hypervisor engine itself) should not be making ANY outbound connections (possible exception for software updates). Your question is how to setup Windows Firewall so that I can restrict my Hyper-V guest instances to only allow outgoing connections on normal HTTP/HTTPS ports. The answer, as MDMarra said, is to configure either the GUEST SYSTEM'S firewall or an upstream firewall on your network, just as you would if the guests were running on physical hosts. Hyper-V is completely uninvolved in this picture. Pretend it doesn't exist. –  voretaq7 May 31 '12 at 18:56
2  
@AnthonyGreco That's just wrong. VMWare is a company, not a product. Parallels is desktop virtualization where VMWare ESXi and Hyper-V are server virtualization and work very differently. Honestly, you should get a book or two on the topic, you seem to need more understanding than a 500 character comment on this site can give. –  MDMarra May 31 '12 at 19:02
3  
VMware Fusion and Player are both Type 2 hypervisors. Hyper-V is a type 1 hypervisor. They function very very differently. Hyper-V is analogous to VMWare ESXi, not Player or Fusion. I'm sorry if you took offense to anything that I said, but this is a site for professional systems administrators. If you're a professional and you're in charge of these systems and don't know these things, then getting a book on the topic is the least you should be doing. –  MDMarra May 31 '12 at 19:09
show 8 more comments

You have to be careful with configuring outbound port rules. For instance, if this machine is domained, assuming it is, then you can't simply disable all traffic as it would kill the communication to the various AD Controllers.

You can setup outbound port restriction rules and then specify the ports you wish for it to block. The problem you may end up having is the dynamic port ranges. For instance, AIM will utilize multiple ports on the outbound connection which are harder to block.

Microsoft has a good article here about how to change the default behavior of the firewall to block all and then specifically allow certain connections only. Maybe this would help the most?

share|improve this answer
    
one concern i had was I dont really care the outbound port, as like you said that changes, i care to block based by destination port. However it's an outbound (not inbound) connection. Also I need to block by application, in this case Hyper-V, so it shouldn't effect any other application besides this one. –  Anthony Greco May 31 '12 at 18:45
    
on that note I also tried completely blocking outbound on the application as a test and it still had internet access... I assumed I may have been blocking the wrong EXE that handles the transfer of the data? –  Anthony Greco May 31 '12 at 18:46
    
@AnthonyGreco Hyper-V isn't an application. You can block the manager application but that does nothing to block the child partition. I think your best bet here is to change the default behaviors and then open up the required outbound ports and services. Not really sure how else to do it, the important thing here is that you must do this from the Child Partition (a.k.a. Guest OS). The firewall settings on the Root Partition (a.k.a. Host OS) do not affect the children, depending on your setup. Hyper-V Architecture: msdn.microsoft.com/en-us/library/cc768520(v=BTS.10).aspx –  Brent Pabst May 31 '12 at 18:49
    
Well lets assume than I was running VMWare. I can't image it being impossible to block a instance of VMWare from connecting to a specific port, because it's an application like any other. Are you saying it's not possible to tell AIM it can connect on port 15, but not port 20? –  Anthony Greco May 31 '12 at 18:54
    
I have absolutely no problem switching to any other program to run these virtual machines if it's possible. I need to know before I do if it is indeed, possible or they will work the same? –  Anthony Greco May 31 '12 at 18:57
show 4 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.