Server 2008 and Windows Firewall

I stumbled across something very interesting today regarding these two components that is worth sharing, especially for anyone else managing a Server 2008 environment. Many of us got used to disabling the firewall in Server 2003 unless we needed to solve very specific security requirements with limited resources. The Firewall in Vista/Server 2008 has been completely revamped and is now a truly stateful firewall complete with profiles, profile-specific rules, and the ability to separately manage inbound/ outbound traffic. Host-based firewalls certainly add complexity to any environment and one has to be very cognizant of hosted services as well as consuming applications and users. Troubleshooting can be frustrating if you forget that “oh yeah that server has its firewall turned on”.

In my current dev environment I disabled the firewall on all servers, 2003 and 2008, via GPO. This is how you do it in XP and 2003 so the same applies to 2008, right? While this does in fact disable the firewall in 2008, there appears to be an underlying system dependency on the firewall service in Server 2008. I installed the April Windows updates on both a Server 2008 STD (x86) VM and a Server 2008 STD (x64) physical host. After rebooting, both servers came back up fine but were completely inaccessible from the network. No PING, no RDP, no CIFS. From the servers themselves, outbound traffic flowed without issue, to the internet, ping other hosts, browsing, etc. This was baffling especially since the firewall was disabled. Nothing should be blocking traffic! I followed the usual troubleshooting methods of digging through logs, checking driver revs, I even added a new vNIC and reinstalled vmTools in my VM thinking that maybe the virtual device had become corrupted somehow. Nothing worked!!

So I decided to do a packet capture to dig a bit deeper hoping that maybe the answer would become clear in the annals of the IP stack. Ok I see ICMP echo-requests coming into the server but it’s not replying, hmm. Let’s try a telnet to TCP 3389, I see SYN messages but the server isn’t sending a SYN-ACK back, what is going on here?? It seems that the server is flat choosing to not respond to inbound traffic. The firewall is definitely disabled.

Thinking this had something to do with Windows update, I opened a sev3 case with Microsoft. In the meantime I continued to troubleshoot and finally developed a work-around before they called me back. There is no stated dependency or published best practice (that I’ve seen) that recommends leaving the firewall enabled on Server 2008 lest you risk network problems. I think most people assume that it’s a security feature that can be safely disabled without adversely affected normal server performance or function [as it should be]. To fix the problem I enabled and started the firewall service, then in the firewall management MMC set all 3 profiles to allow/allow for inbound/outbound access. Both problem servers are now accessible and functioning perfectly on the network.

This experience changes the way I will setup Server 2008 environments as it appears the firewall is a mandatory service that the network service depends upon for normal operation. Microsoft doesn’t have a KB or any information yet about this issue so the support people are kicking my case up to the product teams for review. I also submitted a change request on the Connect site so hopefully someone will take notice and at the very least write a KB stating that the firewall service is a required component of Server 2008. Ideally this dependency will be dropped altogether but we’ll see. Here is my submission:

https://connect.microsoft.com/WindowsServerFeedback/feedback/ViewFeedback.aspx?FeedbackID=464554

To sum: leave your firewalls turned on in Server 2008 and if you wish to make them transparent then do so by allowing all traffic inbound/outbound for all profiles. Don’t disable the service!!