securing windows farm using iptables

securing windows farm using iptables

[Fritz Mesedilla]

As our network is part of a large network, we cannot rely on our mother company to protect us sub companies.

I have been helped by a lot of our list members about subnets and proper iptables usage. 
I thank you for the assistance you have given me. 
This time, I have a bigger problem.

How can I protect a windows exchange server and domain controller?
windows farm --- linux iptables -- internet

Again, I cannot change the windows exchange to linux postfix. 
Although it is within my authority to move to linux, hundreds of people using the windows farm won't be glad for a drastic change. I am slowly moving some people to linux though. :D

For the exchange server, what ports do I need to open? Do I need some port forwarding? I want to create some sort of routing through iptables so I can secure the windows server as well.

For the domain controller, people said I need to make sure dns is open. What else do I need to open up? Again, can I just do some routing for the dns?

Thank you so much for the help!



fritz <www.mesedilla.com>
---
+ Basta Ikaw Lord

----------------------------------------------------------------------
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the sender immediately by e-mail and delete this e-mail from your
system. Please note that any views or opinions presented in this
email are solely those of the author and do not necessarily represent
those of the company. Finally, the recipient should check this email
and any attachments for the presence of viruses. The company accepts
no liability for any damage caused by any virus transmitted by this
email. 

Overture Media, Inc.
Direct Line: (632) 635-4785
Trunkline:   (632) 631-8971 Local 146
Fax: (632) 637-2206
Level 1 Summit Media Offices, Robinsons Galleria EDSA Cor. Ortigas Ave., Quezon City 1100

RE: securing windows farm using iptables

[Rob Sterenborg]

> How can I protect a windows exchange server and domain controller?
> windows farm --- linux iptables -- internet
> 
> Again, I cannot change the windows exchange to linux postfix. 
> Although it is within my authority to move to linux, hundreds 
> of people using the windows farm won't be glad for a drastic 
> change. I am slowly moving some people to linux though. :D

You don't have to. Put a Linux/Postfix mail relay between Exchange and
the internet and firewall the machine. Then you can also do spam/virus
filtering, etc.
Your people won't notice it (well, smart ones maybe).

> For the exchange server, what ports do I need to open? Do I 
> need some port forwarding? I want to create some sort of 
> routing through iptables so I can secure the windows server as well.

For pop/imap/ldap access you could do portforwarding, but also proxying.
In that case maybe Delegate is what you want but there could be better
options than Delegate. (http://www.delegate.org/delegate/)

> For the domain controller, people said I need to make sure dns 
> is open. What else do I need to open up? Again, can I just do 
> some routing for the dns?

If the DC requires DNS and has a DNS service ; yes. That can be covered
with NAT.

You can configure Exchange to use a smart host (in the above example :
Postfix) which does the actual sending of email on the internet. Then,
local DNS is enough for Exchange.


Gr,
Rob

RE: securing windows farm using iptables

[Fritz Mesedilla]

Thanks Rob! I'll look up delegate!


fritz <www.mesedilla.com>
---
+ Basta Ikaw Lord



> -----Original Message-----
> From: Rob Sterenborg [mailto:rob@sterenborg.info]
> Sent: Friday, October 24, 2003 3:49 PM
> To: netfilter@lists.netfilter.org
> Subject: RE: securing windows farm using iptables
> 
> 
> > How can I protect a windows exchange server and domain controller?
> > windows farm --- linux iptables -- internet
> > 
> > Again, I cannot change the windows exchange to linux postfix. 
> > Although it is within my authority to move to linux, hundreds 
> > of people using the windows farm won't be glad for a drastic 
> > change. I am slowly moving some people to linux though. :D
> 
> You don't have to. Put a Linux/Postfix mail relay between Exchange and
> the internet and firewall the machine. Then you can also do spam/virus
> filtering, etc.
> Your people won't notice it (well, smart ones maybe).
> 
> > For the exchange server, what ports do I need to open? Do I 
> > need some port forwarding? I want to create some sort of 
> > routing through iptables so I can secure the windows server as well.
> 
> For pop/imap/ldap access you could do portforwarding, but 
> also proxying.
> In that case maybe Delegate is what you want but there could be better
> options than Delegate. (http://www.delegate.org/delegate/)
> 
> > For the domain controller, people said I need to make sure dns 
> > is open. What else do I need to open up? Again, can I just do 
> > some routing for the dns?
> 
> If the DC requires DNS and has a DNS service ; yes. That can 
> be covered
> with NAT.
> 
> You can configure Exchange to use a smart host (in the above example :
> Postfix) which does the actual sending of email on the internet. Then,
> local DNS is enough for Exchange.
> 
> 
> Gr,
> Rob
> 
> 
> 

----------------------------------------------------------------------
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the sender immediately by e-mail and delete this e-mail from your
system. Please note that any views or opinions presented in this
email are solely those of the author and do not necessarily represent
those of the company. Finally, the recipient should check this email
and any attachments for the presence of viruses. The company accepts
no liability for any damage caused by any virus transmitted by this
email. 

Overture Media, Inc.
Direct Line: (632) 635-4785
Trunkline:   (632) 631-8971 Local 146
Fax: (632) 637-2206
Level 1 Summit Media Offices, Robinsons Galleria EDSA Cor. Ortigas Ave., Quezon City 1100