I have few machines connected to an Active Directory. In that, i want to isolate 3 servers (these 3 are distributed environment set up for testing purpose). I don't want other machines to connect with these 3 or share the resources assigned to these machines.
2 Answers
Microsoft calls this "Server Isolation" and implements it using IPSec. http://technet.microsoft.com/library/cc770626(WS.10).aspx
You'll need setup a firewall. Either using Windows' built-in advanced firewall (which IMO is not that advanced), or use a 3rd party firewall (I had good experience with Outpost Firewall Pro), or use a firewall appliance.
-
Can you go into some detail about what you find deficient in the Windows firewall?– mfinniJan 5, 2015 at 13:28
-
IIRC, it's because with Windows' own firewall, deny rules always win against allow rules. So, it's impossible for me to block a subnet except some hosts within.– pepoluanJan 5, 2015 at 13:44
-
That's a good point; it's mostly correct. If you have an IPSec connection between the allowed hosts, that's an authenticated bypass rule and will override the block rule for the rest of the subnet. That's exactly how Server Isolation is intended to work, in the answer I provided.– mfinniJan 5, 2015 at 13:51
connect
and defineshare resources
.