12 votes

For an internet-facing, all-roles-in-one Exchange server, what do I need to let through the firewall?

What mfinni said, except that we forward three ports to a behind-the-firewall all-in-one Exchange box: 25: SMTP 80: HTTP (redirect to OWA HTTPS) 443: HTTPS This works fine for people with Androids,...
12 votes

Windows 10 - Disable warning notification about disabled firewall via GPO

Click the Start button, type Security and Maintenance. (This should take you to Control Panel\All Control Panel Items\Security and Maintenance in the Control Panel.) You can also go directly to the ...
  • 131
10 votes
Accepted

Windows 10 - Disable warning notification about disabled firewall via GPO

It's not possible to disable the firewall notifications alone, but since Windows 10 build 1607 it has been possible to disable all Security and Maintenance Notifications using HKEY_CURRENT_USER\...
  • 44.5k
9 votes
Accepted

For an internet-facing, all-roles-in-one Exchange server, what do I need to let through the firewall?

That looks mostly correct for a wide-open all-protocols implementation. Some suggestions: Unless you have mail clients, with a business justification, that require all that, limit it to just 25, 80, ...
  • 35.8k
9 votes

Windows 10 - Disable warning notification about disabled firewall via GPO

Computer Configuration -> Administrative Templates -> Windows Components -> Windows Defender Security Center -> Notifications -> Hide all notifications
9 votes

Windows 10 - Disable warning notification about disabled firewall via GPO

I have spent 3 days testing this on 2 machines. When the following is in place the notifications do not pop up for the the firewall. When I remove them they comeback. I also tested inserting this into ...
8 votes

Windows firewall blocking network shares through VPN server

I realize this is almost three years late, but I just spent today fighting with the same problem. I did get it working, so I figured I'd share. Note that I'm using a Windows 7 PC as the file server; ...
  • 81
8 votes

PsExec Slow to connect when Windows Firewall Enabled

Apparently this is an issue with the Group Policy client when enabling "Remote Service Management". The fix is to run the following command: netsh advfirewall firewall set rule name="Remote Service ...
7 votes
Accepted

Do new Windows firewall rules affect currently open connections?

Changing firewall rules will definitely affect open connections. Rules take effect immediately, and the firewall will prevent any more traffic going through closed ports. These are older articles, ...
7 votes
Accepted

Block an application from accessing the network, except for a single IP address

According to this answer you can't create an exception for an outgoing block rule. So instead you will need to create multiple block rules for the executable, so as to cover the entire IP address ...
7 votes

Hardening a file-serving Windows Server 2019 instance

First of all, reinstall the server, because : This one might be compromised and can't be trusted anymore. Windows is secure by default, and maybe someone lowered the security settings of your server, ...
  • 6,435
6 votes

Enable file and print sharing command line - how to enable it just for profile=private

netsh advfirewall firewall set rule name="File and Printer Sharing (SMB-In)" dir=in profile=public|private|domain new enable=Yes|No To set three profiles together at one time, use: netsh advfirewall ...
  • 61
5 votes

How can I use netsh to find a rule using a pattern

On Windows 10 I get a warning when I execute netsh advfirewall, saying that future Windows versions may not support that feature anymore and one should use PowerShell instead. Luckily, what the OP ...
  • 150
5 votes

Apache tomcat server win8 cannot be accessed outside of local host

The 8080 is the tomcat port. Should allow the Tomcat on the firewall (it is not allowed by default)... Firewall - Allow an app or feature through Windows Firewall - Another program - browse Tomcat7....
5 votes

Does Windows Firewall have the ability to log which exe is blocked?

p0rkjello answered correctly but left key things, after struggling for hours I found the solution. Open CMD with administrator privilege, paste command auditpol /set /subcategory:"{0CCE9226-69AE-11D9-...
  • 151
5 votes
Accepted

Copy a Windows Server Firewall address list from one rule to another using Powershell

What you need to do is: Get the original rule by name Get the address filter out of it Get the new rule by name Set the address filter in it And yes, you can merge a lot of those into a one-liner, ...
4 votes
Accepted

AWS Override VPC DHCP - Additional Option Sets for RRAS VPN Clients

As far as I'm aware, this is simply not possible within an Amazon VPC, as they use DHCP for all of their IP assignments within a VPC subnet, static IP addresses are assigned by using Elastic Network ...
  • 9,475
4 votes
Accepted

AWS Security Groups vs Windows Firewall

I always do both. It's a matter of who you trust more, Amazon, or yourself. Perhaps one day the AWS security groups may be broken, disabled, circumvented. In that (unlikely) case, I have a second ...
  • 3,833
4 votes

AWS Security Groups vs Windows Firewall

Disabling one or the other is not best practice for long term network security. Best security practice is to maintain both a host-resident firewall and an AWS security group on your instance always. ...
4 votes
Accepted

Curious about some failures with DCDIAG

I don't see much value in opening the firewall in order to pass the test other than eliminating those errors from the DCDIAG results. Reading the event logs isn't a fundamental operation of AD and the ...
  • 109k
4 votes
Accepted

Windows Firewall - difference between disable and "block"

Disabling a rule means that the rule will no longer take effect. The block action refers to the behaviour of the rule itself...that is should it allow or block the traffic matched by that rule. So ...
  • 1,674
4 votes

Windows Firewall misbehaving

OK, so I found that the setting 'Apply local firewall rules' was being set to 'no' by group policy: this is confirmed in gpresult: GPO: Server firewall - logging only Folder Id: SOFTWARE\...
3 votes

Windows Firewall: Remote Desktop block action by local policy

I had the same issue and found it was due to a space in the GPO comma delimited list. I documented this on my blog: TLDR: Don’t put any spaces in the IP address list for the GPO setting for ...
3 votes

Teamviewer VPN blocked by Windows Firewall

I also had this problem, and it could also be easily bypassed by turning off firewall - however I said NO to that solution (for security reasons)..... I solved this by setting sharing options (no ...
  • 131
3 votes
Accepted

A software firewall with web interface / login possibilities for single windows server

If this is a company setup we're talking about here, there's no reason at all for that SQL server to be accessible from the internet. If you need to allow access from roaming clients, use a proper ...
  • 3,416
3 votes

How do I disable the firewall on a single interface in Windows 7?

There is an GUI option to disable a firewall on a specific NIC with Advanced Security, here is how to: go to CP --> System & Security ---> Windows Firewall --> advanced setting(left ...
  • 31
3 votes

Enable file and print sharing command line - how to enable it just for profile=private

Circling around the subject there are rare cases when using local language names doesn't work, ie. Polish Udostępnianie plików i drukarek (SMB — ruch przychodzący) = File and Printer Sharing (SMB-In). ...
  • 31
3 votes

AWS Security Groups vs Windows Firewall

I don't know if it's a "best practice" from the community, but Amazon recommends doing it. "We recommend that you disable Windows Firewall and control access to your instance using security group ...
3 votes
Accepted

How to block CIFS (mounting) access for certain users in Windows Server 2012 R2?

It sounds like you're trying to work around a political problem with a technical solution. The "right" (IMHO) way to do this is to stop trying to hack up user specific outbound firewall rules and ...
  • 16.6k
3 votes
Accepted

Windows Server Wail2ban and Folder Sharing not working together - Error 4625 no IP

I now have this working with a few alterations. I have changed the NTLM settings back to default, this is not necessary to do unless you have followed other articles and changed these settings. A ...

Only top scored, non community-wiki answers of a minimum length are eligible