Home / server / Questions / 324404
In Process
Alex
Asked: 2011-10-25 12:09:05 +0800 CST

Windows 2008 firewall config

  • 772

Is there any way to add a firewall rule that essentially says, "deny if remoteip= and localport DOES NOT EQUAL ?

I have a network interface connected to a shared network and on that network I only want one TCP port available. But the server is connected to multiple private networks so the private network firewall profile is insufficient here.

windows-firewall

1 Answers

  1. I think it will be much easier to create a rule if you follow these rules:

    1. Deny everything from everywhere on every port.

    2. Open only what you want: netsh advfirewall firewall add rule name=”Rule” dir=in action=allow enable=yes remoteip=172.16.1.1 profile=private protocol=TCP localport=80

    I think you're making it more difficult than it actually is. You should always follow this pattern. Specific DENY rules go out of control very quickly. It's much easier to deny everything and maintain ALLOW rules only.

    • 0