Win 7 Firewall rules for lab exam environment

[HeyMerlin]

Hi, I'm trying to figured out a way to configure Windows 7 firewall rules via GPO for the following environment:

• Local account only, no domain accounts (this is easy via GPO)
  
• Need access to one web server that serves the exam
  
• Need access to CAS, DNS, and AD machines
  
• Do not block traffic from specific machines used for administration.
  
• Block everything else.
  
• 
  

 

In Linux and Mac this is relatively easy using iptables and ipfw respectively:

• allow all out going traffic
  
• restrict incoming to be allowed from only specific IP addresses.
  
• 
  

 

I can not see a way to configure a rule to be applied to all incoming traffic and not just incoming connections (connections initiated from an external source). I considering the following configuration:

• Block all incoming connections unless matched by a rule
  
• Block all outgoing connections unless matched by a rule
  
• Add rules for the following:
  
• - Allow all DHCP (UDP, ports 67 & 68)
  
• - Allow all traffic to our DNS servers (I have a list of these)
  
• - Allow all traffic to our CAS servers (I have a list of these)
  
• - Allow all traffic to our AD servers (I have to get a list of these)
  
• - Allow all traffic to our exam server
  
• - Allow all traffic from our administration servers
  

 

Does this sound reasonable? Is it possible with Windows 7 firewall? Has anybody done this?

 

Note: I have read similar posting regarding ISA servers, network firewalls, etc. We are on a large campus and I do not have configuration access to our network equipment including proxies, content filters, etc. Hence why I'm trying just to use the Windows 7 firewall rules if possible.

 

Cheers,

Merlin.

[SYNACK]

Yes, just use group policy > computer config > Windows Settings > Windows Firewall > etc.

 

I do this to push out exceptions to stations for certain dirty programs that don't make their own on install.

[p858snake]

I would put a box inbetween your network and the wider network running something like Squid or the likes.

 

Hi, I'm trying to figured out a way to configure Windows 7 firewall rules via GPO for the following environment:

* Local account only, no domain accounts (this is easy via GPO)

Why only a local account and not a domain account?

 

What user rights does the local account have?

[HeyMerlin]

Yes, just use group policy > computer config > Windows Settings > Windows Firewall > etc.

 

I do this to push out exceptions to stations for certain dirty programs that don't make their own on install.

 

Thanks for the reply. I have used GPOs to manage the Firewall settings previously however mostly for the usual things: exceptions for specific programs, exceptions for specific ports, etc. I had not tried fully controlling all outgoing and incoming connections. My initial look into it did not show a clear way of doing this with the Windows firewall as it is much more connections oriented rather than traffic oriented than iptables or ipfw. However, I now have a configuration up and running on my dev/test boxes that works. I plan to post the details to this thread when I'm back at work next in case others are looking for the same information.

Edited April 7, 2012 by HeyMerlin

[HeyMerlin]

I would put a box inbetween your network and the wider network running something like Squid or the likes.

 

 

Why only a local account and not a domain account?

 

What user rights does the local account have?

 

Unfortunately on our campus I have no direct access to the networking equipment so injecting any sort of hardware/software solution to isolate the lab is impossible (University campus with 20K+ students). Not to mention that I know I have other machines outside the target lab on the same subnet/switch stack so separating them out would painful.

 

Domain accounts are in much the same situation. The AD is administrated centrally. I have rights to add/edit/delete OUs, GPOs, computers, but not user objects. So adding domain accounts or changing existing domain user accounts is out.

 

I can limit the login access to the students within the target class in the target lab however currently student accounts are subject to folder redirection and store all user folders on a file server. I need to restrict access to all user files for the exam so Local accounts seemed to be the easiest way. This way they have no access to anything in their profiles on the lab machines or on the file servers (either ones in our department or others on campus). I can use GPOs to create/enable/disable/delete local accounts easily enough. The local accounts are your basic non-privileged limited user account, very similar to what a standard domain user is.

 

I'm certainly open to any and all suggestions of different/better ways to meet this sort of lab exam environment requirement. As most of you probably experience, the requirement for this came to my attention with next to no notice so I have had to put something together quickly if not elegantly. I'm hoping to improve the configuration after this set of exams is over so as to be better prepared for the next time.

[HeyMerlin]

I have followed up this thread with a blog post under my EduGeek profile outlining the final configuration that I used. With the length of the entry I figured the blog would be a better place as well as easier to find in the future.