3

Windows default firewall setting on the Domain controller seems to be opening a number of ports to 'any' type of connection. All I want open to the internet is the RDP port.

Can and should I manually restrict each of the inbound rules to allow the scope to be only 'local subnet'? is there a simpler way to do this?

4
  • How is your network layed out?
    – Massimo
    Feb 14, 2010 at 13:02
  • Ok, I'll try restating. HOW IS YOUR NETWORK LAYED OUT? Do you have a local subnet? Do you have domain member computer which need to talk to this DC? Do you have a gateway, a firewall, something you can use? Does this DC have a public IP address? What about other computers? Please, try to provide more informations here.
    – Massimo
    Feb 14, 2010 at 17:44
  • On cloud hosting. 3 servers, 1 webservrr,1 databases,1 dc. All have rdp but I only have port 80 open on webservrr. Each computer has 2 nics, one dchp public and 1 for private network.
    – zsharp
    Feb 15, 2010 at 2:11
  • Oh my God, WHY?!?
    – Massimo
    Feb 15, 2010 at 6:10

4 Answers 4

1

A domain controller needs to be quite opened in order to provide its services to your network; it just shouldn't be directly connected to the Internet.


Edit

Ok, let's see what you can do here.

Running things like you're doing now is definitely a source for troubles, you should avoid it at all costs.

You have two solutions:

  • Remove the "private" NIC from all servers, use only the public IP address on them (but use a static one, not DHCP!) and configure the firewall on each of them to only allow connections between them and from where you'll be RDPing into them.
  • Remove the "public" NIC from them, effectively putting them in a private LAN, and add another computer running Windows RRAS or ISA Server (or FFTMG, or Linux, or whatever else you want) with two network cards, one public and one private, acting as a firewall for your network.

Whatever you do, don't stay with two NICs and public/private IP Addresses at the same time on all your computers. This way, you get the troubles of both solutions plus multihoming, and the benefits of none.

3
  • See comment above
    – zsharp
    Feb 14, 2010 at 16:58
  • Why is it a problem if no external ports (except rdp)are open? Isn't that the point of a firewall?
    – zsharp
    Feb 16, 2010 at 17:59
  • The problem is having two IP addresses on each server. This totally screws up your networking in a domain environment.
    – Massimo
    Feb 16, 2010 at 18:47
2

If you're using Windows Firewall (or any other type of software firewall running on the machine itself) to protect your boxes from the internet then you're doing something wrong. Firstly it implies that each of your boxes has a direct connection to the internet, and secondly it puts you in a situation where you have multiple firewalls to configure and manage.

You need to get a proper firewall appliance in and configure your routing so that all internet access goes through it. Giving yourself a single point of access to or from the internet is a basic security requirement. This needn't be complex or expensive and will help you sleep easier at night.

1
  • Problem is Iam on a hosted cloud service so I have to use rdp to connect to each server
    – zsharp
    Feb 14, 2010 at 16:56
1

Try Windows Firewall with Advanced Security, which allows you to do more than the 'consumer-friendly' control panel UI.

You might also consider a third party firewall provider.

0

Try the following link:

Service overview and network port requirements for the Windows Server system http://support.microsoft.com/kb/832017

Hopefully this will help.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .