One of my servers (running Windows Server 2003 with Service Pack 1—SP1) has two NICs; one is connected to my internal LAN and the other is connected to the Internet. I want to enable Windows Firewall on the Internet connection but not on the LAN connection. I could do this prior to SP1 with Internet Connection Firewall (ICF), but I can't find a way to do it with the new Windows Firewall. Any advice?
You're right; you can't enable Windows Firewall on some network connections and not others, but there is a solution to your problem. You can create Windows Firewall exceptions that allow traffic from your internal LAN to flow to your server unimpeded. For each server program or port that local clients need to access, you'll have to create an exception that enables that port or program. To limit the exception to local clients, simply specify the subnet of your local LAN in the exception's scope field. For instance, Figure 1, shows an exception that lets clients on subnet 192.168.100.0 access file and printer sharing resources on the server. (Figure 1 also shows an exception for Remote Desktop.)
Of course you'll need to create exceptions for any ports or programs that need to be accessible from the Internet as well. For these exceptions, you can leave the scope blank to let clients from any address connect.
The only risk involved in creating exceptions based on your local subnet with Windows Firewall is that if an attacker succeeds in sending spoofed packets to the server's Internet NIC that appear to come from your local subnet, Windows Firewall might allow them because it applies exceptions to all network connections. Although this scenario is unlikely, it's possible depending on the type of Internet connection you have and how secure your ISP's router is. If you have a device between the server and your Internet connection that can filter out packets whose source IP address begins with 192.168, your problem is solved.
