First time VPS user, and still a beginner at Windows Server 2003.

Is the built in (simple) windows firewall considered sufficient if all I'm going to do is expose a few ports and block everything else, or do I need to consider another solution for an internet facing firewall?



Windows Firewall is a good, basic firewall. If all you want to do is block open access to the server and open individual ports for particular services, then its fine for that. Problems start to occur when you want to open a large range of ports, this can be done with scripts, but makes management much more complicated. Also if you want to restrict access to a port to only particular IP's or block rogue IP's from your server, windows firewall can't do that. So if you need any of these facilities you will need to look for a different solution.

As Windows Firewall is a software firewall, you also have the same problems experienced by all software firewalls. In the event of a DDOS attack the firewall can become overloaded by requests and cause your server to grind to a halt. Hardware firewalls are much more capable of handling this, and if they do have problems, its unlikely to cause an issue on your server.

  • Actually yes, The firewall in Windows 2003 can allow the use of a port to specified IP's or ranges, and block the port for all other addresses. See the 'Change Scope' button. But the firewall in Windows 2008 is much better, this is true. – quux Jun 4 '09 at 8:29

See this link:


Basically the firewall has it's limitations, and even Microsoft only see it as a "supplemental solution".

What size is the network that you want to keep behind the firewall, and what traffic do you want to let in or out?

  • The network consists of this one internet facing machine with a VPN connection to another network. The MySQL only needs to be accessable to this machine - it sounds like I can have windows firewall open or closed for a port, but I can't restrict that port so that it only accepts connections from this machine. I can configure MySQL to ignore connections from other machines, but I like to prevent that earlier as well... – Adam Davis May 8 '09 at 15:03
  • To be fair to MS, the linked page says "In addition, Windows Firewall is designed to be a supplemental security solution; it should be part of a security architecture that implements a variety of security technologies." In other words, they are simply saying that one should take a layered approach to security, which is good advice. – quux Jun 4 '09 at 8:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.