Firewall – Windows 2008 core HyperV 4 ports open- what’s required for remote management

firewallhyper-v-server-2008-r2netshwindows-server-core

On a brand new install of Windows 2008 core (for use as a hyper V host(
There are 4 ports open to the world:

135/tcp   open  msrpc
445/tcp   open  microsoft-ds
2179/tcp  open  unknown
49154/tcp open  unknown

I tried blocking one of them with the rule netsh firewall delete portopening protocol=TCP port=135

But nmap -PN still shows it as open! I am a lot more experienced with Linux, so I am not sure if these ports are a security risk or not, but I would rather close them to the world.
How can these ports be blocked using netsh advfirewall firewall ?

To expand on this further, what are the most locked-down firewall rules that can be put in place to allow remote management using server manager, and hyper V manager, from a single trusted IP address.
To put it another way, I want to manage these new servers from a single remote machine, and allow no access to anyone who is not using that IP.

Best Answer

  1. Pull the network cable out. I'm sure the RPC service is much more secure than it used to be but having ports 135 and 445 open to the world would make anyone who had to deal with the Blaster and Sasser worm more than a little nervous.

  2. Set the firewall to block everything inbound.

  3. Only allow the traffic you want, from the IP addresses you want it from.

Better yet, put a hardware firewall in between that server and the Internet.

Related Topic