I have a Windows Server 2008 R2 configured to provide internet access to Clients connected over VPN using the native RAS of Windows.

There is a need to block certain outgoing TCP ports from the clients on the server side, however, Windows Firewall on the server seems to only control connections attempted locally.

The client connections to the internet aren't even showing on the server using netstat -a

Even configuring Windows Firewall to block all outgoing traffic seems to take effect only on connections attempted by programs running on the server.

Is there a way to apply the server's firewall rules to the client connections being routed through?

1 Answer 1


It turns out the way to do it is not through the Windows Firewall.

In the RRAS settings there's the possibility to configure a stateless packet filter, but the control is very limited, and I couldn't specify a restriction to be applied to the VPN clients only. The ristriction would also get applied to applications running locally on the server (which is something I don't want). There is no way to specify an IP range (either all IPs, or just one specific).

RRAS settings Outbound Packet Filter

Then I found out about the Network Policy Server (NPS, %windir%\system32\nps.msc). And there the control can be better refined. So I created a Network Policy like this: Policy Page0 Policy Page1 Policy Page3

So by restricting the policy to a certain Windows Group of users this has solved the issue properly.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .