3

Every exception in my windows server firewall that starts with "File and Printer Sharing" is disabled (ordered by name, so that includes domain, public (active), and private profiles).

The Network and Sharing Center's options for everything except password protected sharing are off.

Why would I still be able to access a network share on that server via an address like "\\my.server.com\" over the internet?

The firewall is on for all profiles and blocking incoming connections by default. A "netstat -an" command on the server reveals the share connection is occurring over port 445 (SMB). I restarted the client to ensure it was actually re-establishing a new connection successfully.

Is the "Password protected sharing: On" option in Network and Sharing Center bypassing the firewall restrictions, or adding some other exception somewhere that I'm missing?

EDIT: "Custom" rules are not the problem. It's the "built-in" rules for Terminal Services that was the problem. Can you believe port 445 (File Sharing Port) has to be wide open to the internet to use Terminal Services Licensing?)

6
  • 2
    Check for custom rules, like those not in groups particularly.
    – Chris S
    Sep 24, 2012 at 20:12
  • I sorted by port and was surprised to find that both "Terminal Services (NP-In)" and "Terminal Services Licensing Server (NP-In)" are allowing access through port 445. Is that normal? It's not a custom rule; it's built-in: "This is a predefined rule and some of its properties cannot be modified."
    – Triynko
    Sep 24, 2012 at 20:22
  • Sure enough, that was the problem. Upon disabling those two rules, and using CurrPorts to kill the original connection from the client, the client could no longer connect. Those TS exceptions are enabled on all profiles, so that's a major security hole in file sharing, IMO.
    – Triynko
    Sep 24, 2012 at 20:27
  • Wonder if it's related to this hotfix: support.microsoft.com/kb/974195
    – Triynko
    Sep 24, 2012 at 20:38
  • 2
    "Terminal Services Licensing communicates by using RPC over named pipes. Service has the same firewall requirements as those of the “File and Printer Sharing” feature." - terminalserviceslog.com/blog/index.php/2008/06/29/… SERIOUSLY MICROSOFT!!!
    – Triynko
    Sep 24, 2012 at 20:48

2 Answers 2

0

I think you're confusing things a bit, Triynko. Those ports don't have to open to the Internet for internet connected clients to connect. They only have to be open between your Remote Desktop Server and your Remote Desktop Licensing server. They're also used for remote management of the Remote Desktop Services. The description fields on those firewall rules say as much.

The only port(s) that needs to be open to the Internet if you haven't reconfigured the defaults are 3389 for direct connections or 443 to your RDS Gateway server.

2
  • A down vote with no explanation? Bad form. Sep 25, 2012 at 5:44
  • Not sure who down voted it, but it's gone now. I understand what ports need to be open to what, but my point was that the Terminal Service's firewall configuration, a built-in rule, has a default setting that opens port 445 to the Internet, so that file shares are accessible from the Internet even when all other file sharing exceptions are turned off.
    – Triynko
    Jan 3, 2013 at 1:11
0

Had the same problem and @Triynko basically provided the right answer (different services though):

So in my case, it was not anything terminal service related, but the following two rules, that were allowing traffic for port 445 TCP:

  • Remote Access Management (NP-In)
  • File Server Remote Management (SMB-In)

So thanks for that!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .