Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have Windows Server 2003/2008 machine, and I deployed some application on this machine. I want to put this machine in a sandbox environment, which means I want this machine to be able to access only proxy/gateway, its private used SQL Server database server, and I want to avoid network access from this machine to other machines in lab server room. Any easy solutions?

BTW: my current environment is, I have a server which runs some Beta software in a Lab server room. It connects internet through proxy/gateway. Since the software is Beta, I want to reduce the risk of being hacked from internet and controlled by hacking sofwtare to attack my other servers in the same Lab server.

thanks in advance, George

share|improve this question

If by saying you have a '2003/2008 machine' that you can choose the o/s, then i would choose to use server 2008 as it has a much better built-in firewall service. it is better as it supports both incoming and outgoing traffic filters.

physically isolating (dmz) the server from the rest of your environment is perhaps the best choice for preventing communication with the other machines in the lab.

If this is not possible, the aforementioned firewall should be adaquate to allow only communication to the devices that need to talk with it (clients and the proxy) and the ports that are necessary in order for the application to work.

this does not mean that it is necessarily safe from attackers as that would require more end-to-end knowledge of the application, systems and networking infrastructure that is in place.

share|improve this answer

If your server can reach the proxy/gateway it means that you want it to go outside. That will break the sandbox. It's not because you prevent inbound connection that you are safe.

If you download a malware, then the walware will connect to outside, create a tunnel and then hacker can come to your server through the tunnel.

To have a sandbox:

  • Put the server in a DMZ, with a firewall
  • If it's a 2008, you can use the embedded firewall (stateful, both inbound and outbound)
  • You can use IPsec in a domain joined network to create a virtual network where only member of the ipsec cloud can speak together
share|improve this answer
+1 for mentioning domain isolation – Oskar Duveborn Jul 19 '10 at 8:13

Put it on its own private network with specific routing and firewall rules according to your wishes (for a sandbox that would be no routing / deny all - using physical console/virtual console for access).

share|improve this answer

Do your switches support VLANs? If they do, that's what you're looking for.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.