RRAS Port Filtering Reference

Built-in port filtering for Windows Servers (pre 2008 Server)

Update: Since Microsoft has decided that multi-homing a Windows Server 2008 R2 Domain Controller is "a huge no-no", administrators that need to selectively drop all but desired packets on an interface can use this RRAS Port filtering method to secure their systems when Network Location Awareness (NLA) incorrectly indentifies internet connections as "Domain Network".

Back in the day when dedicated firewall devices were expensive, using the built-in Routing and Remote Access Service (RRAS) to perform Network Address Tranlation (NAT) and port blocking was an economical alternative for small businesses that needed to be frugal. For small businesses that only needed a port or two to be open for inbound traffic and needed the VPN feature in RRAS, a second network card was all that was needed.

With hours of research and testing, I was able to determine how to use RRAS for port filtering in Windows 2000 Server. One of the side-effects was that when using RRAS for inbound port filtering, any traffic that was in response to outbound requests needed those ports open also. This had the benefit of limiting outbound traffic to well known protocols, in the hope of mitigating any malware communicating on non- standard ports.

Juding from the feedback, this guide has saved other administrators a bunch of time. Thanks for all the positive comments! This guide will setup port filtering for an Internet connection, only the ports desired for inbound and outbound traffic are open.

With Windows 2003 Server, I have mostly abandoned using port filtering, opting for the 'Use Basic Firewall' option in RRAS instead. I still reference this page frequently as quick reminder for some of the port numbers used by common protocols.

Windows Server 2008 R2 Note: the 'Use Basic Firewall' option has been removed from RRAS, so the old Windows 2000 method of applying Input Filters will need to be followed.

A side note: if I understood correctly, these same filters can be applied within the advanced TCP/IP properties for the External Adapter up to Windows 2003. The advantage I read was that the filtering occurs at the kernel level which is supposed to be more secure, the disadvantage is that a reboot is required everytime the filtering changes!

Basic assumptions for the server:
- Running Windows 2000 Server
- Already Running RRAS services
- Not running Proxy Server or ISA server (although the filters would be similar)
- My example below uses the external IP address: 192.168.1.2 (customize per your needs)

Of course, if you are applying these filters to a server via a remote control session, be extremely careful NOT to filter out your remote control session. Also, I am NOT a networking expert, take this advise at your own risk. Any glaring errors found please let me know ASAP. Select from the list below per your needs, do NOT simply add everything I have listed.

To configure the filters, go to: Start > Programs > Administrative Tools > Computer Management. Expand: Services and Applications > Routing and Remote Access > IP Routing > General. In the right pane, right-click the WAN Interface (that you are configuring) > Properties > (General tab), click Input Filters... click Add... then add your first filter. AFTER adding your FIRST filter, then be sure to select the option at top for 'Drop all packets except those that meet the criteria below'.

Alternative method: You can use the netsh command to script the import of these filters. You can download the script file that I tweak & use to quickly enter these filters. More information can be found at Microsoft in Article 242468.

If anyone would like to see some common additions made, or if this page saves you a couple minutes, please send me an email: JayRO@OhmanCorp.com.

Changing a filter set You can use the netsh command to assist changing of these filters. It would be nice to output just the filter stuff, but you'll need to dump all the IP Routing information then weed the dump file.

Syntax to dump current configuration: netsh routing ip dump > FilterList.txt
Then edit the dumped text file, the filtering information is right near the beggining. In my case, the external interface was named "wan", so delete starting with second line reset through the line set filter name="WAN" filtertype=INPUT action=DROP.

Then find the line with fragcheck=, delete that line down to the end but leave popd. You now have a base to work with.

To change all dstaddr=<local address>, you'll need 2 sets for this block, one set changing the word 'add' to 'delete'. The second set change dstaddr=<old IP address> to dstaddr=<new IP address>. To add an additional set of filters, just do the second set. There is no sense in working with filters that have dstaddr=<0.0.0.0>

Syntax to import the text file configuration: netsh -f FilterList.txt.
-f switch = UseScriptFile

Reference:
IANA Port Number Reference