1

I'd like to expose a machine running Windows Server 2012 to the internet. I plan to run a single application that uses a specific port (say 12345) and then use RDP through 3389 to logon and manage it. I would use the firewall to block access to all but these two ports.

Assuming the single application itself is secure, I'd like to know whether there are aspects of security I need to consider, and if so, what they are.

Update 9/26/16 Sorry I didn't respond sooner; one of my email filters marked your reply as read. Thanks for replying.

I plan to rent a server, or virtual server, from someone like 1&1. Based on your response I guess I'd rent two and use one as a router. Maybe all of their servers sit behind a router - I'll have to ask.

I've noted your bulleted suggestions and they all make sense. I'll look into smart CDN services.

I think I understand the matter of dealing with DDOS attacks on the open ports but I'm not quite clear about how the machine is vulnerable if I've blocked all ports except for the application and RDP. Could you expand on this a little?

2

I wouldn't recommend connecting any machine direct to the Internet if you can help it. There are too many attack vectors that you are exposing yourself to, many of which will be unknown.

In any case, doing so would be very unusual indeed. In almost every case, you would connect the server via a router that would have at least some basic protections built in. Things such as invalid packets and basic Denial of Service attack protection are common. You would also use that to limit the incoming open ports and forward incoming traffic to the correct internal IP address (NAT).

In addition, you need to make sure that:

  • The server & its software is constantly patched. Ideally, patches should be pushed from a trusted server deeper inside a protected internal network.
  • You are running anti-malware protection. At least Windows Defender.
  • You should turn off every process that isn't needed and uninstall all unnecessary software and services
  • You should move the RDP connection onto a non-standard port. You can do this at the router/firewall using port forwarding or on the server itself.
  • You can also configure the RDP server to use TLS which will provide additional protection over the standard RDP traffic.
  • You must make sure there are no default user names on the server and that any user ID's have very strong passcodes, especially admin users.
  • You should use another machine - preferably further inside a protected network - to grab logs from the server and those logs should be monitored for unusual activity. This should be done automatically using a monitoring system.

You might also want to think about denial of service attacks. If the application that is being served is a web service, you might consider using a smart CDN service such as Cloudflare to provide smart caching and DDOS protection. In that case, you can restrict incoming connections to the app port to only be from the CDN.

Of course, how much effort you put into this depends partly on the value of the information the server is handling. But you also have some responsibility to the rest of the Internet to ensure your server doesn't end up as part of a botnet.

  • If I were to close all ports but the (relocated) RDP and app port, and then use the Windows Firewall Scope setting to restrict the remote IP address to only those that are trusted would that address the DDOS attack and the other vectors you referenced? – Will Sep 26 '16 at 15:44
  • Yes, that should do it as long as even the used ports don't return anything when accessed from a non-trusted device. That's easily tested of course but should be the case anyway. It is possible that you could be subject to a flood attack - that's a DDOS that clogs up your Internet connection or overloads the router. However, they are generally rare unless someone is likely to specifically target you. If you are a potential target, you need to get together with your ISP to work out mitigations. – Julian Knight Sep 26 '16 at 19:44
  • Sorry I didn't respond sooner. I don't seemed to have received an email on your comment. Regarding your suggestion that used ports don't return anything: tcp servers listen() and then accept() when someone connects. I'm not sure how you'd avoid this as you need to get something from the connector (first round of handshake, etc) to find out whether the server should proceed. How would you avoid this condition? – Will Oct 27 '16 at 17:28
  • All I meant was that all inbound traffic except the ports you want should be silently dropped which should be the default. – Julian Knight Oct 29 '16 at 21:41
  • Ok, so there's no avoiding the condition. I think I'm clear now. – Will Nov 11 '16 at 22:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.