Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is Windows Firewall suitable for running as the sole protection on a production web server? Is it hardened enough? Robust enough? and tested enough?

I'm running a VPS with Rackspace on their cloud offering. It's running Windows Server 2008. I don't believe there are any other firewalls between it and the outside world. I've got a few things on there ranging from my blog through to a couple of client websites. None of which are eCommerce but I'm sure the clients would like their data kept private.

share|improve this question
Suitable for running? Yes. Sufficient on its own? Rarely. Can you describe a little more? – Jeff Ferland Oct 12 '11 at 14:05
I think we need a bit more information to make an informed opinion. Which version of Windows, how will it be managed, by sole protection do you mean no other firewalls between it and your clients, etc? What is the criticality of the asset and what types of threats are you trying to protect it against? – Scott Pack Oct 12 '11 at 14:43
Thanks Scott, I see your point. – Greg B Oct 12 '11 at 16:35

I guess it is up to you and your experiences. We (the company I'm working for) are using Windows Firewall. As far as I know, a lot of small enterprises are running Windows Firewall. It is "only" a firewall, and is therefore not more secure than what you make it yourself. Consider it ACL (Access Control Lists) you specify what traffic you allow and what you do not.

I can recommend these two sites for you, if you consider using Windows Firewall.

This one is a "How to configure windows firewall in a small enterprise:

And this one is a textfile provided by Microsoft with an Introduction to Advanced Configuration of Windows Firewall:
Introduction to Windows Firewall with Advanced Security

share|improve this answer

It sounds like your firewall and webserver are on the same machine -- this increases your attack surface.

You need to quantify the assets that you are protecting, then you can determine the amount of money to spend protecting them.

share|improve this answer
Host based firewalls work like that. Network based firewalls protect VLANs from accessing each other. Host based firewalls (also knowns as HIPS) can protect the host itself from any access even on the same LAN segment. – security_obscurity Nov 1 '15 at 6:51

I'm not sufficiently familiar with the Windows firewall, but I think it does not allow really fine-grained control but only "Please allow WWW". Hence, it is only suitable for beginners, IMO. But there are more fundamental problems to consider:

If the underlying Windows system has a problem, chances are that both, the firewall and the webserver, become compromised, allowing the adversary to extend his influence as he likes. Especially if they reside on the same machine.

In contrast, you could significantly reduce the attack surface if you deploy a BSD-based firewall in front of the Windows server. BSD has much less bugs/month and the packet filter would be able to prevent the exploitation of bugs on the windows box or at least restrict/monitor communication.

Due to the reduced code base, update rate and bug rate, the BSD box also adds only minimal maintenance overhead once it is deployed. If you have someone familiar with Linux/iptables it may also be worth looking into a specialized Linux distribution, such as Shorewall, or strip down your favorite Linux distribution.

share|improve this answer
The firewall, at least on modern server instances, is fairly configurable. One might need to use GPOs or other non-clicky interfaces, though. – Scott Pack Oct 16 '11 at 1:02

I would say no, it is not. Your firewall is running on the same server that is providing content or resources and that is considered to be bad practice. The attack surface available to an attack is to large.

What we did to get around this is to book a small CentOS Linux machine in addition to the Windows machine, setup IPTables as a firewall and use Nginx to proxy all port 80 and 443 web requests through to IIS on the windows machine.

The web app users get a response from a Ngix server and there is a proper layer of security and control BEFORE they even see IIS.

That's my .02$


share|improve this answer
"The attack surface available to an attack is to large." please explain: what is the attack surface, and how larger is it? – curiousguy Jun 19 '12 at 20:22
@curiousguy: Essentially, the problem is that with the Windows server exposed to the Internet, everything on the server that is listening to network traffic - which is a lot of stuff, though most of it will only listen to internal or even loopback traffic - is separated from the Internet only by firewall software that itself is part of the server's attack surface. By placing a dedicated firewall (possibly plus load balancing) box in front of the web server, you can have a minimal Internet-reachable attack surface, and defense in depth (because the Windows box is still firewalled too). – CBHacking Nov 1 '15 at 8:08

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.