Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

On a brand new install of Windows 2008 core (for use as a hyper V host( There are 4 ports open to the world:

135/tcp   open  msrpc
445/tcp   open  microsoft-ds
2179/tcp  open  unknown
49154/tcp open  unknown

I tried blocking one of them with the rule netsh firewall delete portopening protocol=TCP port=135

But nmap -PN still shows it as open! I am a lot more experienced with Linux, so I am not sure if these ports are a security risk or not, but I would rather close them to the world. How can these ports be blocked using netsh advfirewall firewall ?

To expand on this further, what are the most locked-down firewall rules that can be put in place to allow remote management using server manager, and hyper V manager, from a single trusted IP address. To put it another way, I want to manage these new servers from a single remote machine, and allow no access to anyone who is not using that IP.

share|improve this question
    
is this in a domain based enviro? –  tony roth Jun 15 '12 at 16:32
    
@tontroth No it isn't, I am now able to access the server using my management server (same credentials) but there is no domain controller where the new servers are getting installed, just straight to internet. –  Rqomey Jun 15 '12 at 16:41
add comment

2 Answers

up vote 2 down vote accepted
  1. Pull the network cable out. I'm sure the RPC service is much more secure than it used to be but having ports 135 and 445 open to the world would make anyone who had to deal with the Blaster and Sasser worm more than a little nervous.

  2. Set the firewall to block everything inbound.

  3. Only allow the traffic you want, from the IP addresses you want it from.

Better yet, put a hardware firewall in between that server and the Internet.

share|improve this answer
    
Thanks Chris! Yea 2008 seems to have about 60 firewall rules (each service seems to have a rule even if it's sharing a port. I think I'll have to go through them all. –  Rqomey Jun 16 '12 at 14:39
    
@Chris_McKeown Is it better to set a global rule saying block everything inbound, or should each of the (approx 60) active rules be changed (in the scope section) instead? –  Rqomey Jun 18 '12 at 8:59
    
Is a hardware firewall out of the question? Even a basic NAT router/firewall would make things easier. –  Chris McKeown Jun 18 '12 at 9:07
    
I have requested it, but due to the nature of the company, once a decision is made it is rarely changed. Also a firewall may be regarded as a single point of failure, so that brings it's own problems. –  Rqomey Jun 18 '12 at 9:10
    
Update: I manage to convince the company to create an internal only network for management. Before this I had gone through each firewall rule and set the scope remote IP (This was done using the remote management console) to the management address, and this seems to have worked. –  Rqomey Jun 19 '12 at 7:35
add comment

Instead of using the tools remotely, consider using them locally from the server. And access the server via RDP. it only needs a single port (3389) open and will let you remotely manage the VMs the same as you would locally on your box. I find the performance almost the same and for the most part unnoticable. (assuming your internet connection isn't dialup, in which case, remote management would suck too).

share|improve this answer
    
Hi mike! It's actually 2008 core so it's just a basic command line, no ui at all, so it can't really be managed through rdp unfortunately –  Rqomey Jun 16 '12 at 14:35
    
I totally missed that! IN that case, Chris' suggestion of blocking everything and opening up only what you need from that single IP is the way to go. –  MikeAWood Jun 18 '12 at 18:56
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.