Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Every exception in my windows server firewall that starts with "File and Printer Sharing" is disabled (ordered by name, so that includes domain, public (active), and private profiles).

The Network and Sharing Center's options for everything except password protected sharing are off.

Why would I still be able to access a network share on that server via an address like "\\my.server.com\" over the internet?

The firewall is on for all profiles and blocking incoming connections by default. A "netstat -an" command on the server reveals the share connection is occurring over port 445 (SMB). I restarted the client to ensure it was actually re-establishing a new connection successfully.

Is the "Password protected sharing: On" option in Network and Sharing Center bypassing the firewall restrictions, or adding some other exception somewhere that I'm missing?

EDIT: "Custom" rules are not the problem. It's the "built-in" rules for Terminal Services that was the problem. Can you believe port 445 (File Sharing Port) has to be wide open to the internet to use Terminal Services Licensing?)

share|improve this question
2  
Check for custom rules, like those not in groups particularly. –  Chris S Sep 24 '12 at 20:12
    
I sorted by port and was surprised to find that both "Terminal Services (NP-In)" and "Terminal Services Licensing Server (NP-In)" are allowing access through port 445. Is that normal? It's not a custom rule; it's built-in: "This is a predefined rule and some of its properties cannot be modified." –  Triynko Sep 24 '12 at 20:22
    
Sure enough, that was the problem. Upon disabling those two rules, and using CurrPorts to kill the original connection from the client, the client could no longer connect. Those TS exceptions are enabled on all profiles, so that's a major security hole in file sharing, IMO. –  Triynko Sep 24 '12 at 20:27
    
Wonder if it's related to this hotfix: support.microsoft.com/kb/974195 –  Triynko Sep 24 '12 at 20:38
2  
"Terminal Services Licensing communicates by using RPC over named pipes. Service has the same firewall requirements as those of the “File and Printer Sharing” feature." - terminalserviceslog.com/blog/index.php/2008/06/29/… SERIOUSLY MICROSOFT!!! –  Triynko Sep 24 '12 at 20:48

1 Answer 1

I think you're confusing things a bit, Triynko. Those ports don't have to open to the Internet for internet connected clients to connect. They only have to be open between your Remote Desktop Server and your Remote Desktop Licensing server. They're also used for remote management of the Remote Desktop Services. The description fields on those firewall rules say as much.

The only port(s) that needs to be open to the Internet if you haven't reconfigured the defaults are 3389 for direct connections or 443 to your RDS Gateway server.

share|improve this answer
    
A down vote with no explanation? Bad form. –  Ryan Bolger Sep 25 '12 at 5:44
    
Not sure who down voted it, but it's gone now. I understand what ports need to be open to what, but my point was that the Terminal Service's firewall configuration, a built-in rule, has a default setting that opens port 445 to the Internet, so that file shares are accessible from the Internet even when all other file sharing exceptions are turned off. –  Triynko Jan 3 '13 at 1:11

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.