I'm sure something like this has been asked many many times over the Internet. I'm asking again because I need situation-specific response. I've already set up a home web server. My setup is like this:

I have a Windows 10 machine in my home that is connected to a WiFi router. The machine is running web server at a specific port (not the default 80), using Microsoft IIS 10. I've setup port forwarding on the router to this port, and setup static IP on my Windows machine too so the internal network IP doesnt change. As for external IP, I'm using the DuckDNS.org service to provide a free dynamic DNS web address, and I've written my own software to keep my external IP up-to-date with DuckDNS website. The Windows machine is using the in-built firewall for preventing attacks on this IP from the Internet.

All this is working very nicely. I can access my home web server from around the world. It's all working great. At the moment only I'm using this web server. I plan on creating further websites for my colleagues and co-workers to collaborate.

EDIT: In addition to installing antivirus and IPS system, how do I go about tightening security on my home WiFi router from external intrusion? Links to guides would be appreciated.

Thanks in advance! Faraz

closed as too broad by M'vy, user45139, StackzOfZtuff, WhiteWinterWolf, Gilles Sep 14 '15 at 11:12

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Hello and Welcome to Information Security. We are happy to have new user, unfortunately this question is way to broad to be answered here. If you are concerned about IIS security, you should find many topic on the internet by looking for IIS hardening. However, if you have a more precise question about security on IIS, we would be happy to help you there. – M'vy Sep 14 '15 at 7:50
  • Ok thank you. As you can see I'm not very experienced with all this, didn't realize my question has gone too broad. So you're suggesting I do separate research on IIS security and for other things. I'll look into it. – Faraz Azhar Sep 14 '15 at 11:40

Problem 1: You are relying only on the WIndows Firewall for perimeter protection!

Windows 10 Firewall

Problem 2: You seem to think a firewall will protect you from attacks. A firewall will just ensure that unwanted open ports don't show up from the outside. To protect yourself from attacks you need an IPS and an Anti-Virus.

Use a good firewall to protect your web resources. COMODO Internet Security comes with an Anti-Virus, IDS/IPS Module and a Firewall.

COMODO Internet Security 2015

Problem 3: You are using your home WiFi router to host your web server. Now this is the most dangerous thing in my opinion. Especially if you have not configured your router properly.

On an event where your web server is compromised, this set up puts the adversary directly in your home WiFi network. He/she would be able to accessible everything that is connected to the WiFi

I would recommend completely isolating your resources that you are hosting to be accessed externally from your internal network.

  • Thank you. I didn't realize I was too far off from having a secured connection. I will get the anti-virus and IPS installed. Isolating the home WiFi network is going to be costly for me, although I agree that it puts all my other devices at risk. Is it possible to harden the security (in addition to antivirus and IPS) to prevent this from happening? Would appreciate if you could guide me towards some links (or google searches) that provide info on tightening home wifi router security. – Faraz Azhar Sep 14 '15 at 11:44
  • This is one simple thing you can do: If your router is one of the new models, it will have an option called "WiFi Isolation". This feature, depending on the make of the router, will either isolate the LAN interface from the WiFi or all devices connected to WiFi from each other. Using this you can isolate the IIS (which you can connect to a LAN port) and connect all your home devices to WiFi – feral_fenrir Sep 14 '15 at 12:06
  • Understand all the options available in COMODO AV, Firewall and IPS and configure them all to ensure max security. Hardening IIS like the mods have suggests is something you need to look into. – feral_fenrir Sep 14 '15 at 12:07
  • Ok thanks! Thats a good lead to start with. I'll look into these possibilities. – Faraz Azhar Sep 14 '15 at 14:07
  • Any recommendation for IPS? – Faraz Azhar Sep 14 '15 at 14:26

Not the answer you're looking for? Browse other questions tagged or ask your own question.