Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a single NIC DC server set up for a few local client machines to mainly serve Files and provide a consistent computing environment across local client workstations thru Folder Redirection.

Recently, with the addition of VPN thru RRAS (Routing and Remote Access), the windows firewall had to be disabled because they can not function concurrently.

  1. How important is it to have a soft firewall even though the server is behind a HW NAT router?

  2. How does one set up a firewall that will permit MS Exchange, DNS, DHCP, VPN, Domain Controller to continue to function with the local and VPN clients, but block other traffic? (Windows Firewall used to open ports automatically)

After setting up RRAS as shown by http://www.onecomputerguy.com/networking/w3k_vpn_server.htm I looked at http://technet.microsoft.com/en-us/library/dd772723%28WS.10%29.aspx and found a list of ports that need to be opened LDAP 389 and DNS TCP and UDP 53.

To open the ports:

1.) Open RRAS snap-in 2.) Expand Server -> IP Routing -> NAT/Basic Firewall 3.) Open Service and Ports Tab 4.) Manually add each port (ie, LDAP, DNS, HTTP) ports into the list

--Is that the correct way to do allow for the server roles to continue working with client workstations on the LAN and VPN?

DC System: Windows 2003 standard x64

Network Environment: Single NIC - Domain Controller behind SOHO HW NAT router several windows client workstations connected to the SOHO HW NAT router

Server Roles: Domain Controller Active Directory MS Exchange 2007 DNS DHCP

share|improve this question
i've just found out that the RRAS basic firewall cannot be configured for a port range. this may be a real show stopper if some roles require port range access. Windows Firewall can solve the problem by allowing all ports for the application in question. I'm not sure if I need port ranges for the DC, Active Directory, MS Exchange to work –  klau Oct 10 '12 at 0:07
ended up installing a 3rd party firewall, rras's basic firewall wasn't going to cut it –  klau Oct 10 '12 at 6:22
Please post your solution as an answer and accept it so others know how you solved your problem. Regardless, why are you opening up firewall ports for active directory. Please don't tell me you just plugged this server into the internet! –  Brent Pabst Oct 15 '12 at 14:30
No,I'm not opening the ports to active directory on the Internet facing firewall (which would be the HW router). I'm trying to open the firewall ports on the Domain Controller so other workstations on the LAN can access the Domain Controller. Not sure this can be considered an answer. –  klau Dec 12 '13 at 19:24

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.