1

I recently segmented a network and the only hosts that are accessable from every subnet are the AD-Server and the fileserver. Now I want to limit the access to specific shares on that servers to a list of subnets. For example the project folders don't need to be accessable from the laboratory network.

It seems like this is not possible with the capabilities windows server 2012 offers. I can of cause limit the access to port 445 by subnet but thats not what I want. I need a way to filter on the protocol level or sth. like that. Is there a state of the art way to do this?

1

As you are speaking of an AD server and of state of the art solution, just remember that: use groups of users for security, not groups of machines. There are plenty of reasons for that:

  • it is the way security is implemented on Windows at least since Windows NT 3.5
  • IP spoofing is trivial for a user that has an administrative account on a machine
  • users should be educated to think that they are identified by their account, not by the machine they use, and that authorizations are granted to human beings not to machines
  • inter network or inter machine protection is a security feature not an authorization one.
  • ... probably many others
|improve this answer|||||
1

You cannot configure access to individual shares by IP ranges, the most you can do is limit access to SMB as a whole. For that, you can Use Windows Firewall with Advanced Security to modify the scope of the File and Printer Sharing rule (SMB-in) for the appropriate network profile to allow inbound SMB connections specifically from the appropriate subnets Why not use user groups though ? Separate user group for each subnet and assign them proper access.

|improve this answer|||||
1

It seems you are attempting to ensure confidentiality of your data so I would also assume that you have an AD domain established. Implementing security groups into the share permissions would offer much better control over these share drives and allow for greater flexibility and scalability as needed in the future.

Assuming your AD is already established, this would utilize an existing access control method and just build on top of it. If you're worried about other departments accessing the share, you could explicitly deny all for other users.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.