{"id":244,"date":"2021-09-16T10:48:08","date_gmt":"2021-09-16T14:48:08","guid":{"rendered":"https:\/\/www.anthonyfontanez.com\/?p=244"},"modified":"2021-09-16T10:48:10","modified_gmt":"2021-09-16T14:48:10","slug":"windows-firewall-part-1-the-basics-securing-clients","status":"publish","type":"post","link":"https:\/\/anthonyfontanez.com\/index.php\/2021\/09\/16\/windows-firewall-part-1-the-basics-securing-clients\/","title":{"rendered":"Windows Firewall Part 1: The Basics & Securing Clients"},"content":{"rendered":"\n

Part 1 of this series will go over the basic configuration of the Windows Firewall via Group Policy on client endpoints, and go in-depth into a few specific topics that will be referenced\/reused in later posts.<\/p>\n\n\n\n

Overview<\/h2>\n\n\n\n

<\/p>\n\n\n\n

In the majority of cases, clients should be able to be secured by allowing outbound traffic by default, blocking inbound traffic by default, and explicitly allowing any necessary inbound traffic for remote management purposes. Except in the cases of specialized software or hardware, there shouldn’t be a need to open any ports on clients that are generally open from anything, i.e., clients shouldn’t be making services available to other endpoints. Let’s start by taking a look at the firewall on a stock Windows 10 installation:<\/p>\n\n\n\n

\"\"
Windows 10 Stock Firewall<\/figcaption><\/figure><\/div>\n\n\n\n

There’s a great deal of rules that come preloaded; but most if not all of them are unnecessary. Most of these are application-specific rules that are created by default.<\/p>\n\n\n\n

Basic Client Configuration<\/h2>\n\n\n\n

<\/p>\n\n\n\n

To begin, create a new Group Policy Object linked to the top-level client OU, and edit the Windows Firewall section under “Computer Configuration\\Policies\\Windows Settings\\Security Settings”.<\/p>\n\n\n\n

\"\"
Windows Firewall within a GPO<\/figcaption><\/figure><\/div>\n\n\n\n

After opening Properties for Windows Firewall, configure each firewall profile to enable the firewall, block inbound connections, and allow outbound connections.<\/p>\n\n\n\n

\"\"
Windows Firewall Properties – Domain Profile<\/figcaption><\/figure><\/div>\n\n\n\n

Next, customize the settings for each profile to prevent locally configured rules from applying. This will ensure that all firewall rules must be defined via Group Policy, and prevent rules created locally even by an administrator from applying. These settings can be accessed by clicking “Customize” in the “Settings” section for each profile.<\/p>\n\n\n\n

\"\"
Customizing Settings for the Domain Profile<\/figcaption><\/figure><\/div>\n\n\n\n

Next, create a new rule via the wizard to allow inbound ICMP echo requests for troubleshooting purposes. Right-click Inbound Rules, click New Rule, and select Custom.<\/p>\n\n\n\n

\"\"
New Inbound Rule Wizard<\/figcaption><\/figure><\/div>\n\n\n\n

Select All Programs, click Next, select ICMPv4 under Protocol Type, and click Customize. In the customization dialog, select Specific ICMP Types, and then select Echo Request.<\/p>\n\n\n\n

\"\"
Customize ICMP Settings Dialog<\/figcaption><\/figure><\/div>\n\n\n\n

Click OK, then accept the defaults for Scope, Action, and Profile, then give the rule a useful name, such as “Allow Inbound ICMP Echo Request”.<\/p>\n\n\n\n

\"\"
Newly Created Firewall Rule<\/figcaption><\/figure><\/div>\n\n\n\n

Next, create a rule to allow remote SMB access for remote management purposes. This time, use PowerShell to create the rule directly in the GPO using the New-NetFirewallRule<\/code> cmdlet, replacing the parameter values below as necessary.<\/p>\n\n\n\n

$Parameters = @{\n    'PolicyStore'   = 'ad.domain.tld\\Client - Firewall';\n    'Name'          = 'Allow Inbound SMB from management server';\n    'DisplayName'   = 'Allow Inbound SMB from management server';\n    'Direction'     = 'Inbound';\n    'RemoteAddress' = '10.20.30.40';\n    'LocalPort'     = '445';\n    'Protocol'      = 'TCP'\n}\n\nNew-NetFirewallRule @Parameters\n<\/pre><\/div>\n\n\n\n
Further documentation for the New-NetFirewallRule<\/code> cmdlet can be found on the Microsoft Docs<\/a> site. Using PowerShell can make it much easier\/quicker to create many rules, such as additional rules for other remote management purposes, such as WinRM, remote WMI access, etc.<\/p>\n\n\n\n
Summary<\/h2>\n\n\n\n
<\/p>\n\n\n\n
At this point, the most vulnerable endpoints are now drastically more secure. If a client is compromised, there won’t be any ability for it to pivot to other client endpoints and cause further compromise, nor can local firewall rules be created to provide a “backdoor”.<\/p>\n","protected":false},"excerpt":{"rendered":"
Part 1 of this series will go over the basic configuration of the Windows Firewall via Group Policy on client endpoints, and go in-depth into<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[6,7],"tags":[2,3],"class_list":["post-244","post","type-post","status-publish","format-standard","hentry","category-active-directory","category-security","tag-active-directory","tag-security"],"jetpack_featured_media_url":"","jetpack_likes_enabled":true,"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/anthonyfontanez.com\/index.php\/wp-json\/wp\/v2\/posts\/244","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/anthonyfontanez.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/anthonyfontanez.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/anthonyfontanez.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/anthonyfontanez.com\/index.php\/wp-json\/wp\/v2\/comments?post=244"}],"version-history":[{"count":17,"href":"https:\/\/anthonyfontanez.com\/index.php\/wp-json\/wp\/v2\/posts\/244\/revisions"}],"predecessor-version":[{"id":395,"href":"https:\/\/anthonyfontanez.com\/index.php\/wp-json\/wp\/v2\/posts\/244\/revisions\/395"}],"wp:attachment":[{"href":"https:\/\/anthonyfontanez.com\/index.php\/wp-json\/wp\/v2\/media?parent=244"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/anthonyfontanez.com\/index.php\/wp-json\/wp\/v2\/categories?post=244"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/anthonyfontanez.com\/index.php\/wp-json\/wp\/v2\/tags?post=244"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}