How To Disable Firewall In Windows Server 2003

There is a false sense of security when you envision your network as inside and exterior, with a firewall protecting you from hostile users on the outside.

One particularly nasty trouble is when users bring their laptops home, surf, read e-mail, and so plug it correct back in to the corporate LAN on Monday forenoon.

Windows Server 2003 has a adequately flexible host based firewall that you can install to protect your servers from those within your primary firewall.

Here is an Nmap scan of a fresh install of Windows Server 2003 with IIS, and the default client, printer, and file sharing for Microsoft Networks enabled:

[usr-ane@srv-ane ~]$              nmap -sV 10.50.100.112              Starting nmap 3.seventy ( http://www.insecure.org/nmap/ ) at 2005-08-03 17:09 EDT Interesting ports on 10.l.100.112: (The 1655 ports scanned but not shown below are in land: closed) PORT     STATE SERVICE      VERSION 80/tcp   open  http         Microsoft IIS webserver 6.0 135/tcp  open  msrpc        Microsoft Windows msrpc 139/tcp  open up  netbios-ssn 445/tcp  open  microsoft-ds Microsoft Windows 2003 microsoft-ds 1025/tcp open  msrpc        Microsoft Windows msrpc Nmap run completed -- 1 IP address (1 host up) scanned in 42.176 seconds

Allow'south block everything going to this server except port 80, the HTTP port that IIS uses by default, and the standard port for HTTP.

Kickoff, become into the Local Area Connectedness Properties and click the Advanced tab:

fwart1

Click the settings button. Click the On radio button:

fwart2

Click the Exceptions tab, and click Add Port:

fwart3

Enter http (or whatevery you want to call the service), and type fourscore in the Port number box:

fwart4

Click OK until all of the dialog boxes are closed.

The service will exist running correctly right away without a reboot.

Let'southward run some other scan and make sure everything is existence blocked except for port 80:

              [usr-i@srv-i ~]$              nmap -sV 10.fifty.100.112              Starting nmap 3.70 ( http://www.insecure.org/nmap/ ) at 2005-08-03 17:19 EDT Interesting ports on 10.50.100.112: (The 1659 ports scanned but not shown below are in state: filtered) PORT   State SERVICE VERSION lxxx/tcp open  http    Microsoft IIS webserver vi.0 Nmap run completed -- 1 IP accost (ane host up) scanned in 37.085 seconds [usr-1@srv-i ~]$

We are expert.

Now, this box is locked downward so well that information technology will be difficult to authenticate users confronting a domain or share files, of course, only that may be desired in some cases.

Cull what ports you lot accept to have open up and specifically let those ports if needed.

Disallow the rest by default.

If you don't need full time access to file shares on your webserver, consider only allowing access when you prop the new site.

Source: https://www.netadmintools.com/art424.html

Posted by: florescuse1944.blogspot.com