- [Instructor] The Windows Firewall with Advanced Security
remains one of the more important security features
to build into the server operating system.
Windows Defender ATP was designed on the premise
that a breach will happen.
No matter how tight the perimeter may be
when the product is released,
at some point a vulnerability will be discovered
or created, and when that happens,
you want the best team in place to respond.
The Windows Firewall is designed to block
everything that you can on an individual server,
everything that is, except for the traffic that you want.
In the Windows Security app, you can do basic tasks
like define what the protection will be
if you're in your domain or if you're in a private
or a public network profile.
Your servers, however, probably don't wander
into coffee shops the way your users' laptops will.
But this profile architecture is there just the same.
When I open up the firewall and network protection,
there are some quick links to complete
basic common tasks.
I can use this link to allow an app through the firewall,
to allow, say, printer software,
or some specific application that our users may need
from our server.
It will allow those applications
to have their own direct path through the firewall.
The link for advanced settings will take you
to a management tool that is going to be familiar
to any of you who have been administering Windows servers
in previous versions.
This is the Windows Defender Firewall,
or Windows Firewall with Advanced Security.
Here you get a pretty long list of inbound
and outbound rules that you can use to allow
or block traffic for the various services
that ship with Windows Server.
Each of these can be viewed and even edited as needed
to block or allow specific types of traffic.
You can also create new rules for applications
or services that weren't originally in place.
Let's say you want to allow one specific
administrative workstation to administer
this server remotely using PowerShell Remoting.
I can go to the Inbound Rules, an inbound request
to administer this server, right-click
and select New Rule, and there's a wizard
that will walk us through the process.
I'm going to choose a custom rule
because there's several things
that I want to set for this specific rule.
One of the first things I need to specify
is what application makes it through
this port of the firewall.
Well, the application being used
is not what I'm going to be defining,
so I'm going to allow that one to remain as all programs.
The specific protocol and port,
PowerShell Remoting, happens over TCP,
and it happens over port 5985.
You can look up these ports for any of the services.
And with a lot of these services,
you can set the port to whatever you need.
I don't need to specify the remote port.
What I'm saying here is that I want to define
how traffic is going to be allowed into this machine
using TCP and port 5985.
As far as the scope for this rule,
we only want this rule to apply
to one specific workstation.
Only requests coming in through the IP address
that I specify will be allowed to use this rule
to gain access.
So let me go ahead and add the IP address
of our administrative workstation, 10.35.4.76.
And you can see here that you can use a range,
or if you're in an Active Directory environment
and you can specify computers,
you may be able to choose some as well.
But let me go ahead and say OK here.
The action, if all of these rules apply,
allow the connection.
Or if I'm in an environment with security certificates
being passed around, I could choose
Allow the Connection if it's secure.
Only IPsec connections, only recognized certificates
are going to be granted access to this port,
to this firewall rule.
And finally, I mentioned network profiles previously
as they apply to workstations.
When you start defining firewall rules,
it becomes clear where network profiles
are used on a server.
A server may have multiple network interfaces
that connect to different networks.
If I'm on a server with three network interfaces
that all point internally to the Active Directory domain
and one interface that points to the public
or to the Internet, I can use this page
to specify where my different rules apply.
If I don't want any requests coming in
from the Internet to PowerShell Remote into my server,
I can simply uncheck that box.
And if I've set the network interfaces
that connect to my local network as domain profiles,
I can leave that the only box checked.
Setting up firewall rules that are specific
to a network profile will help sort out
which sources the requests will come from
and what types of access will come
from these different locations.
Carefully craft your firewall rules
to allow the access you need
but not grant any unneeded traffic.
This is one of the most important things
you can do in hardening your server's defenses.