Question regarding firewalls
Gregg Hill
In an SBS domain, what firewall ports are really needed for most businesses
to have full functionality? I would like to have the maximum lock-down I can
achieve with normal network and Internet functionality.
I can think of the following, in numerical order:
Inbound ports forwarded in firewall/router:
25 to SBS
443 to SBS
3389 to a 2000 or 2003 terminal server
4125 to SBS
Maximum outbound ports allowed:
20 and 21 for downloads
25 to send mail (preferably only from SBS server's IP)
53 for DNS lookups
80 for web browsing
110 if they use POP3 on external server
123 for NTP
143 if they use IMAP on external server
443 for secure web browsing
2002 if servers are managed with LogMeIn
I cannot think of others that would be needed for normal web browsing, email
access, etc. Do AV apps such as Trend Micro CSM use different ports to get
their updates?
Did I miss any ports?
Thank you for your time!
Gregg Hill
Claus
to use SharePoint.
--
Claus
"Gregg Hill" <bo...@nowhere.com> wrote in message
news:Oq5crudw...@TK2MSFTNGP05.phx.gbl...
Andrew McNab
1723 inbound to SBS for VPN clients
Gregg Hill
Gregg Hill
"Claus" <cjo...@nova-tech.org> wrote in message
news:eVuffNew...@TK2MSFTNGP05.phx.gbl...
Gregg Hill
Thank you!
Gregg Hill
"Andrew McNab" <Andre...@discussions.microsoft.com> wrote in message
news:79747418-53EA-41AC...@microsoft.com...
Leythos
says...
> Hello!
>
> In an SBS domain, what firewall ports are really needed for most businesses
> to have full functionality? I would like to have the maximum lock-down I can
> achieve with normal network and Internet functionality.
>
> I can think of the following, in numerical order:
Assuming that you have a real firewall and not a NAT Router:
Assuming that the users can VPN/Authenticate with the firewall first,
using a web browser or VPN connection.
> Inbound ports forwarded in firewall/router:
> 25 to SBS
> 443 to SBS
> 3389 to a 2000 or 2003 terminal server
> 4125 to SBS
3389 and 4125 are ONLY exposed to firewall authenticated users.
> Maximum outbound ports allowed:
> 20 and 21 for downloads
Only from the SBS box
> 25 to send mail (preferably only from SBS server's IP)
Only from the SBS box - this protects you from malware with its own SMTP
engine. Also setup SMTP Filter to remove attachments not on approved
MIME format list, to large, invalid headers, etc...
> 53 for DNS lookups
Only from SBS box
> 80 for web browsing
Use multiple HTTP Services in the firewall:
HTTP1 - SBS Server - allow all outbound HTTP connections
HTTP2 - Users IP's - Filter through approved Web-Blocking/Filtering
HTTP3 - WHITE LIST - All IP/Subnets for MS and AV and App updates
> 110 if they use POP3 on external server
Only from SBS box - use POP3 Connector on SBS, don't allow personal
email.
> 123 for NTP
Only from SBS box, but this is not a real large threat for network.
> 143 if they use IMAP on external server
Nope, they get email via SBS or not at all.
> 443 for secure web browsing
This one is iffy, as it permits many users to access personal email
accounts and other services. White listing outbound HTTPS works well.
> 2002 if servers are managed with LogMeIn
Ultra VNC on specific ports for each server, only exposed for
authenticated firewall users.
> I cannot think of others that would be needed for normal web browsing, email
> access, etc. Do AV apps such as Trend Micro CSM use different ports to get
> their updates?
They pull using HTTP unless you tell them to use FTP.
I'm a die-hard firewall appliance person, and I don't believe people
have a "Right" to internet access while at work, and I don't tolerate
personal time on the company network. This is one reason we've never had
a compromised network in our history.
--
Leythos
- Igitur qui desiderat pacem, praeparet bellum.
- Calling an illegal alien an "undocumented worker" is like calling a
drug dealer an "unlicensed pharmacist"
spam9...@rrohio.com (remove 999 for proper email address)
Lanwench [MVP - Exchange]
In addition to the other replies-
Your clients should need only HTTP and HTTPS outbound, most likely. Your
firewall should be configured with a deny all by default for the IP address
range used for your client workstations, and 80 and 443 outbound only. Your
users shouldn't be connecting to external POP, IMAP, FTP sites, etc.,
generally.
Your server needs more outbound access - your 'maximum' list is fine in
general, although I'd exclude 110, 2002, 143. I don't know why you'd need
LogMeIn.....
kj [SBS MVP]
119 to post to this newgroup! <g>
Greg,
465/995 (outbound) POP-S for gmail or wait till the users call.
--
/kj
Gregg Hill
Excellent suggestions. I expected nothing less!
I am testing a freeGuard 100 (same as fortiGuard 100) appliance. It has UTM
that takes care of web content, antivirus, antispam, and antispyware. I use
Trend CSMS for SMB on server and Exchange, as well as the desktops.
I like the suggestion for multiple HTTP filters.
I stopped using UltraVNC due to its slowness. I have LogMeIn on all my
client's servers now in case I need a non-TS console session. Using "mstsc
/console" is NOT the same thing...it shows up as a TS session in TS Manager
and has stopped me from certain management tasks.
Gregg Hill
"Leythos" <vo...@nowhere.lan> wrote in message
news:MPG.20fbf67bd...@adfree.Usenet.com...
Gregg Hill
I have LogMeIn on all my client's servers now in case I need a non-TS
console session. Using "mstsc /console" is NOT the same thing...it shows up
as a TS session in TS Manager and has stopped me from certain management
tasks. If I recall, Trend CSM was one of the complainers (may have been
SAVCE???), and I could not fix a problem with it because it said it had to
be done from the console. I was in the server using RDP to hit it (direct
and via RWW), and when it complained, I installed LogMeIn Free, dropped out
of RDP, and used LogMeIn to do what I needed.
Another benefit of LMI is that I can set up a buddy as a secondary user, and
he can easily support my clients when I am on vacation, since the ones I
choose to allow for him will show up in his own LMI account. I can enable or
disable his access with one mouse click.
Thank you for the other comments!
Gregg Hill
"Lanwench [MVP - Exchange]"
<lanw...@heybuddy.donotsendme.unsolicitedmailatyahoo.com> wrote in message
news:e4$nM0iwH...@TK2MSFTNGP05.phx.gbl...
Gregg Hill
crap that has no business in a business.
I use OE to post. Does it still require 119?
Gregg Hill
"kj [SBS MVP]" <Kevin...@SPAMFREE.gmail.com> wrote in message
news:uTB43Gkw...@TK2MSFTNGP02.phx.gbl...
Cris Hanna [SBS-MVP]
--
Cris Hanna [SBS-MVP]
-------------------------------------------------
Microsoft MVPs
Independent Experts (MVPs do not work for MS)
Real World Answers
---------------------------------------------------------
Please do not contact me directly regarding issues
"Gregg Hill" <bo...@nowhere.com> wrote in message
news:O1wrzzkw...@TK2MSFTNGP04.phx.gbl...
kj [SBS MVP]
> The whole point of lock-down is to STOP the gmail, hotmail, yahoo
> mail, etc crap that has no business in a business.
>
> I use OE to post. Does it still require 119?
>
> Gregg Hill
Outbound yes, 119 needed. I hear you. about stopping the cr... , er, "non
business access".
Somehow the whinners frequently win out with some personal email access,
especially when it's one of the execs.
--
/kj
Lanwench [MVP - Exchange]
Well, my stars, who on earth would be doing that from the server? :)
>
> Greg,
>
> 465/995 (outbound) POP-S for gmail or wait till the users call.
Or tell users to check their personal email at home :)
Gregg Hill
I once helped a buddy get rid of Nimda (five servers, four techs, nine
hours, because the owner refused to let us isolate the servers!), and when I
figured out that the owner brought it in via his laptop by opening an email,
I made the comment that, "You (meaning a person, "one") can't just open any
attachment...." The guy got mad and said, "I can open anything I want to
open!"
We just stared in disbelief, then I told him that I would see him the next
day. That went over like a lead balloon.
Gregg Hill
"kj [SBS MVP]" <Kevin...@SPAMFREE.gmail.com> wrote in message
news:ubx615kw...@TK2MSFTNGP05.phx.gbl...
Lanwench [MVP - Exchange]
> Lanwench,
>
> I have LogMeIn on all my client's servers now in case I need a non-TS
> console session. Using "mstsc /console" is NOT the same thing...it
> shows up as a TS session in TS Manager and has stopped me from
> certain management tasks.
Outside of the one you mention below? Or others?
Regardless, I wouldn't want to put it on a server, honestly.
> If I recall, Trend CSM was one of the
> complainers (may have been SAVCE???),
Trend won't let you install the Officescan client on your server during
setup, but no big deal. Once you get the rest of the suite installed, go to
the Trend console URL and click the "install now" link. Done.
> nd I could not fix a problem
> with it because it said it had to be done from the console. I was in
> the server using RDP to hit it (direct and via RWW), and when it
> complained, I installed LogMeIn Free, dropped out of RDP, and used
> LogMeIn to do what I needed.
> Another benefit of LMI is that I can set up a buddy as a secondary
> user, and he can easily support my clients when I am on vacation,
> since the ones I choose to allow for him will show up in his own LMI
> account. I can enable or disable his access with one mouse click.
Well, you could also set him up with RD access & a delegated account, too.
>
> Thank you for the other comments!
No prob.
kj [SBS MVP]
Ah well if you look at it from the server, then no 119, no outbound DNS from
anywhere but the SBS server, and the same with IMAP ( if anything it would
be inbound access only to the exchange server - but I don't ever do that or
inbound POP ), 123 for the SBS server only.
--
/kj
Gregg Hill
I have had problems two other times, but Trend was the only one I can
remember.
I am not sure what you mean by "Well, you could also set him up with RD
access & a delegated account, too." Do you mean add an account on the server
for him to use? If so, that would be a lot more management than just making
him a secondary user in LMI. If I have someone as a secondary user, I can
block access at any time just by disabling his secondary user account. If I
had accounts on each client's server, it would be much more difficult. Yes,
I trust him, but you never know!
What do you have against LMI? The only problem I ever had was one ancient
2000 server on which I had to update the video card driver for LMI to work.
Gregg Hill
"Lanwench [MVP - Exchange]"
<lanw...@heybuddy.donotsendme.unsolicitedmailatyahoo.com> wrote in message
news:%23$LpKElwH...@TK2MSFTNGP04.phx.gbl...
Lanwench [MVP - Exchange]
> Lanwench (love that name!),
<grin>
>
> I have had problems two other times, but Trend was the only one I can
> remember.
I've run into the Trend one, but that's pretty much it.
>
> I am not sure what you mean by "Well, you could also set him up with
> RD access & a delegated account, too." Do you mean add an account on
> the server for him to use? If so, that would be a lot more management
> than just making him a secondary user in LMI.
Why? You can disable an AD account, you can remove its RD permissions via
group membership, etc. - and he can't do anything you don't want him to
(such as manage your own account). It sounds like he's currently using
*your* login or the default/Admin account, once he contacts the
server -which will make any kind of auditing impossible.
If I have someone as a
> secondary user, I can block access at any time just by disabling his
> secondary user account. If I had accounts on each client's server, it
> would be much more difficult. Yes, I trust him, but you never know!
>
> What do you have against LMI? The only problem I ever had was one
> ancient 2000 server on which I had to update the video card driver
> for LMI to work.
I know nothing ill about it and mean no insult. It may be a perfectly fine
product - but it doesn't seem to be designed for servers, and I am really
really cautious about what I put on anyone's server - especially a
DC/Exchange box. And I've never needed it!
Gregg Hill
If I have him as an AD user on my clients' servers, and I have ten clients
with one server each, that is ten times the management of enabling or
disabling one LogMeIn secondary user, should the need ever arise. I can
leave his LogMeIn secondary user account disabled, then when I go on
vacation, I can enable it. In ten seconds, he has access to as many of my
clients as I choose to give him. To do what you propose, I would have to log
into each clients' servers and enable or disable access, one client at a
time.
Yes, he currently could have access via the Domain Admin account, but I have
not given him those passwords (I have never had to have him support a client
while I was on vacation, but I am set up to do so), so RDP or RWW is out for
now. I have known him since he was pooping his diapers and I do not need to
track his every move. No, he does not wear Depends...I have known him since
he was two years old.
If I got really paranoid, I could easily restrict the IP addresses from
which he can access LogMeIn as well. But then again, if I were that
paranoid, he would have no access at all.
I also have it on one NT4 server (long story) and several 2000 servers. RDP
cannot access a console session on those systems.
I also use it to log into servers and workstations to train users. I have
had managers ask me how to do something in their LOB app on the server, and
if I use an RDP console session, they get kicked out, or at the least, I
cannot see what they are doing if I use a regular RDP session. I tried VNC,
but with 30-second delays after every click, it was almost useless. I don't
have that kind of patience!
Many reasons for me to use it, and that's just the free version. LMI IT
Reach is even better.
One other thing: I have had servers that were hung at the "Applying Network
Settings" portion and would not get to the desktop. RDP failed to connect,
but LogMeIn IT Reach was up and running. I accessed it and forced a reboot
or stopped a hanging service.
Gregg Hill
"Lanwench [MVP - Exchange]"
<lanw...@heybuddy.donotsendme.unsolicitedmailatyahoo.com> wrote in message
news:ezdExOmw...@TK2MSFTNGP02.phx.gbl...
Leythos
says...
> I am testing a freeGuard 100 (same as fortiGuard 100) appliance. It has UTM
> that takes care of web content, antivirus, antispam, and antispyware. I use
> Trend CSMS for SMB on server and Exchange, as well as the desktops.
I never believe in putting all my eggs in one basket - I use WatchGuard
which provides all of the same UTM services, but we don't normally
purchase them. Normally we purchase Web Blocking (based on 40+
categories of content type) and we purchase Symantec Corp Ed for
Workstations and Servers, then we also use GFI Mail Security and GFI
Mail Essentials - this combination, along with our other measures, has
passed every audit, all attacks, and has been approved by HS and other
groups.
Since I don't know anything about the FortiGuard, I'm leary of using
something like that - I tend to stick with known, long history, products
that have been proven in out testing and the field.
Mark
Gregg Hill
the firewall with UTM and then Trend CSMS. You have three baskets by adding
GFI.
Gregg Hill
"Leythos" <vo...@nowhere.lan> wrote in message
news:MPG.20fc65e89...@adfree.Usenet.com...
Lanwench [MVP - Exchange]
Hokay - to each his own; it sounds like you have a good system in place to
meet your needs.
Gregg Hill
just using RDP. Try changing screen resolution or refresh rate from an RDP
session...not going to happen!
I had a situation where the person at the console changed the refresh rate,
only to find out that the new KVM did not support such a high rate. I
remoted into it and installed LogMeIn, then used that to change the refresh
rate back to 60Hz.
I have also had the need to change screen resolution remotely, which also
cannot be done via RDP.
As you said, to each his own!
Gregg Hill
"Lanwench [MVP - Exchange]"
<lanw...@heybuddy.donotsendme.unsolicitedmailatyahoo.com> wrote in message
news:uzkxaciy...@TK2MSFTNGP06.phx.gbl...