Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a new Winwdows Sever 2008 R2 machine with two network cards. The situation is as follows:

  • One network card is connected to CompanyLAN_1 (10.0.0.0/24)
  • Through this card the machine can reach 10.0.0.254
  • Through 10.0.0.254 the machine can reach 10.0.0.0/16
  • The other network card is connected to CompanyBackup_1 (192.168.0.0/24)
  • Through this card the machine can reach 192.168.0.254
  • Through 192.168.0.254 the machine can reach 192.168.0.0/16
  • The machine should NOT be able to access any networks beyond 10.0.0.0/16 and 192.168.0.0/16 (the machine should have no internet access at all)

What is the proper/recommended way of setting this up in Win2k8R2?

A) set up the network cards with the proper netmasks and put default gateways to each one

B) set up the network cards with the proper netmasks and put a default gateway to the normal one and add a static route to the backup one

C) set up the network cards with the proper netmasks and add two static routes, one for each?

Any link to official Microsoft references detailing recommendations would be welcome as well.

share|improve this question

1 Answer 1

up vote 2 down vote accepted

The simplest way to do this is not to specify any default gateway. When you do that, only the networks specified in the local routing table will be available.

You should, however, consider using a proper firewall for this machine: not only is it simpler to configure, it's also much more resilient to problems.

share|improve this answer
    
Ohh, the machine is behind multiple firewalls - what we are aiming for here is called multilevel security. E.g. we have the very same ruleset installed on both the local firewall and the proper firewall in front of the machine. Some industries have requirements like this... :/ –  Zizzencs Apr 15 '13 at 9:58
    
Fair enough. I'm not sure it really adds to the overall security but I guess it's a minor enough change it doesn't really matters. –  Stephane Apr 15 '13 at 12:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.