Security Blanket: Vista's Outbound Firewall

The first step is to enable outbound filtering using the Windows firewall with Advanced Security MMC on a single PC:

1. Log on to a Vista PC as a domain administrator and type wf.msc in the Search box on the Start menu and press ENTER.

   To log on to a domain and access other network resources, we’ll need to add a filter, which allows outbound traffic from Vista to designated servers.

2. Expand Windows Firewall with Advanced Security on Local Computer and select Outbound Rules.
3. Right click Outbound Rules and select New Rule from the menu.
4. In the Rule Type dialog, select Custom and click Next.
5. Check All programs. Click Next.
6. Accept the default settings in the Protocols and Ports dialog. Click Next.
7. In the bottom half of the Scope dialog, check These IP addresses under Which remote IP addresses does this rule match?
8. Click Add. Check This IP address or subnet, enter the IP address of your domain controller and click OK.
9. Repeat Step 8 for each server you want to add. In this example, I’ve added two servers: a domain controller and an Exchange Server (Figure 1). To make troubleshooting easier, you may also want to include the IP addresses of any PCs that sysadmins use to administer the network. Click Next to continue.
   Figure 1
10. In the Action dialog, check Allow the connection. Click Next.
11. Check Domain under When does this rule apply? and click Next (Figure 2).
    Figure 2
12. Name the rule Outbound Servers and click Finish.

    Complete Steps 13 to 18 if you haven’t specified a proxy server for Internet Explorer in the Outbound Servers rule.

13. Right click Outbound Rules and select New Rule from the menu.
14. Check Program in the Rule Type dialog and click Next.
15. Check This program path, click Browse to select the path of iexplorer.exe (Figure 3) and click Next.
    Figure 3
16. Check Allow the connection in the Action dialog. Click Next.
17. Check Domain and Public in the Profile dialog and click Next.
18. Name the rule Internet Explorer and click Finish. You should now see two new rules added to the list in the right MMC pane (Figure 4).
    
    Figure 4
    Finally, we’ll enable outbound filtering for the Domain profile.
19. Right click Windows Firewall with Advanced Security on Local Computer and select Properties from the menu.
20. On the Domain Profile tab, change Outbound Connections from the default setting to Block (Figure 5) and click OK.
    
    Figure 5

Now that outbound traffic is being blocked, you should test core functionality on your PC to ensure that you can log on to the domain successfully, access network resources and use Internet Explorer.

Adding Firewall Rules to a Group Policy Object

Once you’re happy that everything is working on your Vista PC, export the rule set and add the configuration to a Group Policy Object (GPO). This will configure all Vista PCs on your network with the same rule set.

1. On your Vista PC, right click Windows Firewall with Advanced Security on Local Computer and select Export Policy from the menu.
2. Name the file rules and save it to your desktop. You should note that this file will contain all Windows Firewall settings, not just outbound filters.
3. Log on as a domain administrator to Windows Server 2008 and open Group Policy Management from Administrative Tools on the Start menu.
4. In the left pane, expand Forest > Domains and select your domain. Because the firewall rules we configured were not designed to be applied to servers, select an Organizational Unit (OU) that contains only PCs. In this example, I have an OU named Clients, which contains all my Vista PCs. Right click the OU and select Create a GPO in this domain, and Link it here.
5. Name the GPO Windows Firewall and click OK (Figure 6).
   Figure 6
6. Right click the new GPO and select Edit from the menu. In the Group Policy Management Editor window, under Computer Configuration, expand Policies > Windows Settings > Security Settings > Windows Firewall with Advanced Security.
7. Right click the Windows Firewall with Advanced Security node and select Import Policy from the menu. Click Yes in the warning dialog, browse to the rules.wfw file saved earlier and click Open.
8. Click OK when Policy successfully imported appears.
9. Click Outbound Rules under the Windows Firewall node and you should see the two additional rules in the list on the right. Close the Group Policy Management Editor window.

Our new GPO will apply to computers in the Clients OU the next time Group Policy is refreshed.