Advanced Security Management in C#

Encoder GS1 - 12 in C# Advanced Security Management

31

The Programs And Services tab shows which program or service (or both) the rule applies to; for this particular rule, it doesn t provide much detail of interest. The Users And Computers tab lets you specify which authorized computers and authorized users are affected by the rule; these settings can be made only for IPsec connections.

31

31

Figure 31-6 The Advanced tab can be used to specify the profile and interfaces to which the rule applies.

If you wanted Remote Desktop connections to be allowed only on local (hard-wired) connections instead of wireless or other interface types, click Customize. Using the dialog box shown in Figure 31-7, you re able to select the interface types to which this rule should apply.

Figure 31-7 The Remote Access option refers to connections through a Virtual Private Network (VPN) or dial-up connection.

Figure 31-8 shows the Scope tab, which contains settings related to the IP addresses from which connections for this rule apply. In the case of Remote Desktop, you might want to only allow connections from certain specific IP addresses or IP ranges such as your local subnet.

Such a configuration can be accomplished through these steps: 1. In the properties dialog box for a rule, click the Scope tab. 2. Under Remote IP Address, select These IP Addresses and click Add. The IP Address dialog box opens.

31

31

31

3. Type the IP address or addresses that will be allowed to connect to this computer in this example, using Remote Desktop. You can use Classless InterDomain Routing (CIDR) notation or enter specific IP addresses. (CIDR notation specifies the number of bits in the subnet mask. For example, to represent a subnet mask of 255.255.255.0, append /24 to the IP address.) The second example shown in the dialog box 192.168.1.0/24 shows how you can include all addresses in a subnet. Most users will quite happily be able to use the default secure configuration included with Windows Vista. However, some networks require additional rules for exotic protocols or a more advanced configuration than the one included by default with Windows Firewall. For these cases, you can configure quite complex rules using Windows Firewall With Advanced Security using the method described previously in this chapter for enabling ICMP Echo Requests.

When Windows Firewall blocks traffic, it doesn t display an (annoying) on-screen alert as some third-party personal firewalls do. However, you can configure Windows Firewall to store a record of its activity in a log file. To enable logging, follow these steps: 1. In the console tree, select Windows Firewall With Advanced Security On Local Computer (the top-level folder). In the Details pane, click Windows Firewall Properties. (Alternatively, right-click the top-level folder and choose Properties.)

2. In the properties dialog box, click the tab for the profile on which you want to collect firewall logs. Under Logging click Customize. The Customize Log Settings dialog box appears.

You ll get the most useful security information by logging only dropped packets, so that Windows Firewall records each connection that was blocked. Logging successful connections tends to create a large file with information that you probably don t need. A log of dropped packets, however, can lead you to IP addresses that are probing your computer.

4. Specify a file name for the log if you don t want to use the default (%SystemRoot%\System32\LogFiles\Firewall\Pfirewall.log). 5. To keep a log from getting too large, specify a maximum file size. To read your log, open it in Notepad or another text editor. Figure 31-9 on the next page shows a sample of a Windows Firewall log. The log uses the W3C Extended Log format, a standard logging format that allows you to analyze data using third-party utilities. To understand what the columns mean, look at the column headers in line 4. (They don t align over the data below, but they re in the correct order.) Table 31-1 on the next page provides a description of each of column.