How To Configure Windows Server 2012 Firewall Print

Firewalls have become an essential part of every network that has access to the Internet. Without firewalls, anyone would be able to access your network and servers and infect them with malicious software. Properly configured, a firewall can substantially decrease undesirable network communications in a local network.

In this article, we will briefly look at how firewalls work in general, the types, and managing a firewall on Windows Server 2012.

The article will show how to create a firewall rule using the firewall MMC and Windows PowerShell. I will use Windows Server 2012, but the procedure applies to other versions of the Windows operating system, with slight variations.

A firewall is a piece of hardware or software that controls the flow of data packets, and it is critical on modern computer systems. It protects private networks and devices from malicious actions coming from public networks in the same way a physical firewall prevents fire from spreading from one area to another. A firewall acts as a defense mechanism which controls network traffic according to the implemented firewall rules.

Computers behind a firewall cannot receive data until the data passes all filters. This enhances security by a large margin and reduces the risk of unauthorized access to private networks. A proper firewall configuration provides your system with a crucial layer of security and lowers the risk of successful hacking attacks. Firewalls can perform many tasks:

As the name suggests, a firewall acts like a barrier between your local devices and the external network. When you send a connection request to your computer or server over the internet, a hacker can interrupt that connection and try to gain access to your private network. With a firewall in place, only the network traffic that matches firewall rules can get through. The sets of firewall rules you define in the firewall settings review every packet for flagged information. If the packet contains the blacklisted data, it cannot pass through the firewall. To make the most out of your firewall, you should precisely define both inbound and outbound rules in order to avoid any unwanted connections.

For example, you can set an inbound rule saying that the data communicated through a specific port, such as TCP port 80, can pass the firewall. That means if the firewall sees a packet coming towards any other port, it will drop it and the data will not reach its intended destination. This does not mean that all data coming through port 80 is legitimate and does not contain malicious data. By default, firewalls do not inspect the payload of the packet. This is something that antivirus and other similar software solutions do.

There are many different types of firewall you can implement in order to control various activities in different places and operating systems. The two main types of firewall are host-based and network-based firewall.

In order to achieve maximum security, you need to apply multiple layers of protection and combine both host-based and network-based firewalls. This will reduce the exposure to external and internal attacks and stop even persistent hackers. If they manage to breach the security at the network layer, a host-based firewall will keep your operating system safe.

Network firewalls use many different technologies for traffic access control. The most common methods to block untrusted traffic to get inside or leave the network include packet filtering, proxy service, and stateful inspection. These three traffic control mechanisms provide network protection in three quite different ways.

This technique of controlling access to a network is the oldest of the three. It works by looking into the source and destination information of the incoming and outgoing packets. The packet filter analyzes the header of every packet and checks if it matches the configured rules. The packet filter firewalls use the following pieces of information to decide whether to let a packet go through or not:

In case a packet’s information is in collision with inbound and outbound rules, the packet filter will either drop or reject the packet. When a packet is rejected, the sender receives an ICMP notification.

For high security, you can configure the filter to accept only those packets that are deemed safe. In this case, it will drop or reject all other packets. In order to ensure not to drop or reject legitimate packets, you can configure the packet filter to accept all packets, except those that are not legitimate. This method is not particularly secure. Finally, the packet filter can hold a packet and let a user decide what to do with it. This happens when a rule does not provide instructions on what to do with that specific packet.

Packet filters do not monitor TCP handshakes. They handle the information on layer 3 and 4 of the OSI model. For this reason, devices behind a packet filter firewall are not protected from spoofing.

A proxy firewall is also referred to as a gateway firewall, or an application firewall. It stands between the internet and the devices in the private network. Since proxy firewalls do not allow direct network connection with local devices, they are the most secure of the three types.

Proxy firewalls perform deep packet inspection rather than merely packet header inspection. Here, the firewall creates a separate connection for every incoming and outgoing packet. Proxy servers can create detailed logs of every event and provide administrators a deep insight into network activity. For this reason, they are much safer and more difficult to bypass.

Since the connection does not occur directly with a device inside a private network, the performance may be hindered. When a client machine tries to connect to the internet, it first needs to establish a connection with the proxy. Then, the proxy creates another session with the destination server. When the packets with information come back, the firewall will inspect them before letting them through. Hence, this process has a negative effect on the speed.

In this case, the firewall inspects every packet and keeps the information for the current connection. This includes TCP protocol information, source and destination IP addresses, and port numbers. When a packet comes back, the firewall will compare its information to the existing saved connections within the flow tables. If there is a match in the firewall’s database of existing connections, it will forward the information.

Stateful firewalls keep track of the connection state and that is how they got the name. When a packet comes in, there is no need to inspect the packet itself. This makes a stateful firewall more efficient than a proxy firewall. The firewall will just look for matching information in the state table and decide whether to let the traffic go through or not.

Windows Firewall with Advanced Security is the management console which stores all Windows Firewall configurations. Windows Firewall is a host-based firewall solution embedded with virtually all current Windows operating systems. It is an essential part of a multilayer security model. Windows Firewall with Advanced Security provides safer inbound and outbound network communications by enforcing rules that control traffic flow for its local machine. There are three available firewall profiles:

The benefits of using Windows Server Firewall with Advanced Security are numerous:

The difference between the two is the level of functionality available to the end-user, that is, the interface itself. Both of them are the same firewall service. The Windows Firewall is easier to use and more consumer-friendly. It is located in the Control Panel and allows you to perform basic firewall configurations.

The Windows Firewall with Advanced Security offers granular control over the inbound and outbound rules, as well as the default firewall profiles. You can modify all advanced firewall configurations using the Microsoft Management Console (MMC) or Windows PowerShell.

You can access Windows Firewall with Advanced Security console in a few different ways. Whichever method you chose, it will open the Windows Firewall MMC where you can make further firewall configurations for all profiles.

Now that you have the Windows Firewall with Advanced Security console open, in the middle you can see the summary of the three firewall profiles. Their default configuration is to permit the outgoing traffic and to limit the incoming traffic.

When you select an option from the menu on the left side of the window, you will see its details in the middle section. On the right side, the menu will show the available actions for the option you previously selected.

The Windows Firewall with Advanced Security console allows you to configure inbound and outbound rules, as well as the Internet Protocol security (IPSec) connections. The Monitoring tab allows you to view the active firewall rules and connection security rules for that server.

Windows firewall rules allow you to state whether to permit or block specific incoming or outgoing network connections. You can choose between multiple parameters and settings for each individual inbound or outbound rule. This includes selecting a program, a TCP or UDP port, protocol, service, or profile that a rule will apply to.

The procedure is the same when creating inbound rules and outbound rules with Windows Firewall with Advanced Security. I will list the steps for creating an inbound rule and you can follow them in the same order when you want to create an outbound rule.

Launch the Windows Firewall with Advanced Security MMC using the method you prefer. You may want to pin the shortcut to the start menu if you use the console on a regular basis.

When you close the wizard, the rule will take effect immediately. You can find the rule in the firewall console when you click on the Inbound rules option. Enabled rules have green checkmark icon while disabled are with grey icons.

To edit any existing rule and make additional configuration, open the Windows Firewall with Advanced Security console and select Inbound Rules or Outbound Rules option. Locate and click a rule to see the actions specific to it in the right pane. Select Properties and another window will load where you can edit the rule settings.

You can also disable, cut, copy, or delete the rule you selected. Make sure you highlight the correct rule to avoid changing firewall configurations for wrong rules.

Tip: you can double click a rule to directly open the Properties window.

This is only one example of how to add a firewall rule using the Windows PowerShell command line. You can find more examples in the Microsoft PowerShell Documentation.

This article explains the basic functions and different types of firewall and details the steps for managing the Windows Server Firewall within the Windows Firewall with Advanced Security interface. The Windows Firewall Management Console is a powerful tool which allows creating detailed configurations. If you carefully followed the instructions in the article, you are now able to manage the firewall on your Windows Server.