I have a host server running Windows Server 2008 and on this I have a Virtual Server (using Hyper-V) running Windows Server 2003. The Virtual server hosts websites specifically. I am trying to use the Windows Firewalls on them (Host and Virtual Servers) to secure them incase my Hardware Firewall goes down (again). I need to have RDP enabled and Specific IP's only allowed. I have this working for the host. However, when I did the same process for the virtual server, RDP wasn't restricted to the specific IPs. Meaning that I could still access the virtual server from an IP that wasn't on the list. So my question is, How is the virtual server's firewalling handled differently/in relation to the host?
The answer depends in large part on how you have configured Hyper-V to do the networking. When you set up a guest OS, you normally configure a virtual NIC (virtual network card), and the settings you selected there will have an impact on how your PC will handle network traffic. Typically, there are a few common options you can choose:
NAT is going to be the default setting, so that's probably what you are running right now. It allows you to connect outside of the network for things like accessing the internet, but without extra tweaking it won't let you establish an inbound connection to it. In this mode the Guest OS sends traffic normally, but your packets get re-written at the gateway to appear to be coming from the Host system. Since your running a webserver you'll most likely want a bridged network.
Bridged network works by essentially treating the Guest system as a "real" machine. The VM has access to the physical network and can directly access any services on it.
Your best bet here is to configure a third option - which would be to set up NAT with port forwarding. By design, this prevents inbound connections to the Guest OS since it will be on a seperate subnet (most likely it will have an IP of 10.X.X.X). If you have RDP running on 3389 - you would set up a rule on your physical router as well as in your NAT settings in Hyper-V to forward traffic on 3389 from your Host adapter to your virtual adapter.