3

I need to block all communication (inbound/outbound) from server A to server B (all ports/all protocols). Server A should communicate with every machine except server B. I can't place firewall rules on server B, so I have placed all rules on server A.

I have done the following on server A:

  • First I disabled all default firewall rules (inbound/outbound) on server A. (This is required.)
  • Then I created an inbound rule that allow access from anywhere.
  • Then I created an inbound rule that deny access to server B (all protocols/ports).
  • Then I created an outbound rule that deny access to server B (all protocols/ports).

I have tested that the access is restricted via ping from both servers, and it seemed to work. But then I installed Nmap on server A and scanned server B. My assumption was that Nmap would not be able to scan server B, as the firewall would block it. But Nmap is able to scan open ports of server B. How is that possible?

Windows Server 2008 is installed on both machines.

  • 1
    I am not fluent on Windows networking, but I suspect your inbound rule that allow access from anywhere is the problem. Try removing that rule and test again. – ThoriumBR Oct 16 '18 at 13:39
  • 1
    As an explanation to @ThoriumBR s comment. Firewalls always work top to bottom. If the first rule allows something, the firewall does not look for other rules, but apply the first found rule. Reference – Nordlys Jeger Oct 16 '18 at 22:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.