The windows firewall with advance security remains one of the more important security features to build
into the server operating system Windows Defender ATP was designed on the premise that a breach will
happen no matter how tight the perimeter may be when the product is released at some point of vulnerability
will be discovered or created.
And when that happens you want the best team in place to respond the Windows Firewall is designed to
block everything that you can.
On an individual server everything that is except for the traffic that you want in the windows security
app you can do basic tasks like define what the protection will be.
If you're in your domain or if you're in a private or a public network profile your servers however
probably don't wander into coffee shops the way your users laptops will.
But this profile architecture is there just the same.
When I open up the firewall and network protection there are some quick links to complete basic common
tasks.
I can use this link to allow an app through the firewall to allow say printer software or some specific
application that our users may need from our server.
It will allow those applications to have their own direct path through the firewall.
The link for advanced settings will take you to a management tool that is going to be familiar to any
of you who have been administering Windows servers in previous versions.
This is the Windows Defender firewall or Windows firewall with advanced security.
Here you get a pretty long list of inbound and outbound rules that you can use to allow or block traffic
for the various services that ship with Windows Server.
Each of these can be viewed and even edited as needed to block or allow specific types of traffic.
You can also create new rules for applications or services that weren't originally in place.
Let's say you want to allow one specific administrative workstation to administer this server remotely
using power shell remote thing.
I can go to the inbound rules an inbound request to administer this server right click and select new
rule and there's a wizard that will walk us through the process.
I'm going to choose a custom rule because there's several things that I want to set for this specific
rule one of the first things I need to specify is what application makes it through this port of the
firewall.
Well the application being used is not what I'm going to be defining so I'm going to allow that one
to remain as all programs the specific protocol and Port Power shall remote thing happens over TGP and
it happens over port 5 9 8 5 you can look up these ports for any of the services and with a lot of these
services you can set the port to whatever you need I don't need to specify the remote port.
What I'm saying here is that I want to define how traffic is going to be allowed into this machine using
TGP and port 5 9 8 5 as far as the scope for this rule.
We only want this rule to apply to one specific workstation only requests coming in through the IP address
that I specify will be allowed to use this rule to gain access.
So let me go ahead and add the IP address of our administrative workstation tend and 35 dot for dot
seventy six and you can see here that you can use a range or if you're in an active directory environment
and you can specify computers you may be able to choose some as well.
But let me go ahead and say OK here the action if all of these rules apply.
Allow the connection or if I'm in an environment with security certificates being passed around I could
choose allow the connection if it's secure only IP set connections only recognized certificates are
going to be granted access to this port to this firewall rule
and finally I mentioned network profiles previously as they apply to workstations when you start defining
firewall rules it becomes clear where network profiles are used on a server a server may have multiple
network interfaces that connect to different networks if I'm on a server with three network interfaces
that all point internally to the Active Directory Domain and one interface that points to the public
or to the internet I can use this page to specify where my different rules apply if I don't want any
requests coming in from the Internet to power shell remote into my server I can simply uncheck that
box and if I've set the network interfaces that connect to my local network as domain profiles I can
leave that the only box checked setting up firewall rules that are specific to a network profile will
help sort out which sources the requests will come from and what types of access will come from these
different locations carefully craft your firewall rules to allow the access you need but not grant any
unneeded traffic this is one of the most important things you can do in hardening your servers defenses.