Windows Server 2003 : Protecting Hosts with Windows Host Firewalls - Internet Connection Sharing

When used, the ICS computer is rarely a dedicated router. Instead, the computer running ICS is used for daily work and pleasure if it is a workstation, and for other services (such as file and print) if it is a Windows server. You should understand its function so that you can disable its use in your Windows domain when necessary, or to ensure that it is securely deployed if you decide to implement it.

To fully understand the capabilities of ICS, you should have an understanding of the following:

• Enabling ICS

• Enabling Internet access to local services

• Using a network bridge with ICS

• Securing ICS

• Managing ICS via Group Policy

1. Enabling ICS

In the typical small network, all computers are connected to the same network and ICS is implemented to provide all computers access to the Internet. To set up ICS, select and configure one computer as the ICS computer. The ICS computer must have two network connections: an Ethernet connection to the local network and a connection to the Internet (via modem, ISDN, DSL, or cable modem). If these network connections are in place, and you have successfully tested the Internet connection, enable ICS as follows.

Click Start and select the Control Panel. Double-click Network Connections. Right-click the network connection to be shared and select Properties. Select the Advanced tab and click "Allow other network users to connect through this computer's Internet connection," as shown in Figure 1. In the figure, the network connection has been renamed to Internet.

Figure 1. ICS is enabled from the Advanced tab of the network connection Properties

Click OK. Configure clients on the network to dynamically obtain an IP address.

When ICS is enabled, the following changes are made:

• The local network connection is assigned the IP address 192.168.0.1. Consequently, any connections to other computers on the network will be lost. In addition, any Internet connections must also be refreshed.

• The ICS service is started.

• A DHCP allocator is available to assign addresses with a default range of 192.168.0.0 with a subnet mask of 255.255.255.0. The ICS host address is reserved, and clients are assigned addresses in the range of 192.168.0.2 to 192.168.0.254.

• A local DNS proxy is enabled.

• Autodial is enabled.

You cannot disable the DHCP allocator or change the default range of addresses.

2. Enabling Internet Access to Local Services

ICS uses NAT to provide computers on the internal network access to the Internet. While NAT is not meant to provide security for internal hosts, external hosts do not know the actual IP address of internal hosts. Therefore, if you want to provide access to services such as web services, FTP services, or SMTP services, you must explicitly configure access. Begin by clicking Start and selecting the Control Panel. Double-click Network Connections. Right-click the ICS network connection and select Properties. Select the Advanced tab and click the Settings button to display a list of services, as shown in Figure 2.

Figure 2. When ICS is enabled, access to services running on the private network can be configured

Click to select the service you wish to provide access to. On the Service Settings page enter the name of the host that offers this service, as shown in Figure 3, then click OK.

Figure 3. Identify the server that hosts the service to which you allow access

Click OK twice to exit the network settings Properties pages.

3. Using a Network Bridge with ICS

In a more complex small network, the ICS computer may have more than one private network connection. To enable ICS when the host computer is connected to multiple LAN segments, you must bridge the private networks before enabling ICS

Begin by clicking Start and selecting the Control Panel. Double-click Network Connections. Select and hold down the Shift key and then click each of the adapters for the connections that should be included in the bridge. Wireless network connections, Ethernet, IEEE-1394 adapters, and telephone line connections can be included in a bridge. Do not include the network connection to the Internet.

Release the Shift key. Click on the Advanced menu and select Bridge Connections. The bridge is added to the Network Connections page and identifies the network connections that are bridged, as shown in Figure 4.

Select the Internet network connection and enable ICS, as explained in the earlier section "Enabling ICS."

4. Securing ICS

ICS does not add security to the Internet connection. It does, however, provide NAT services that hide the IP address of the hosts on the internal network. Even so, it is

Figure 4. Private network connections can be bridged to allow access from all private network connections to the Internet over a shared public network connection

still possible for an Internet-based attack to be successful. It is also possible to misconfigure ICS and expose the ICS host and computers on the private network to the risk of compromise. Take the following steps to secure ICS services:

• Implement a firewall. A separate firewall can be placed between the ICS host and the Internet, the Windows built-in firewall can be enabled, or some other personal firewall can be installed. Be sure not to set up ICS without turning on the Windows Firewall. If no other firewall sits between the ICS host and the Internet, then the Windows Firewall (or some other firewall) should be used.

• When configuring ICS, ensure that ICS is enabled on the Internet connection, not on the connection to the private network. If ICS is configured on the private network connection, hosts on the internal network are subject to attack from the Internet if the ICS host is connected to the Internet.

• If a network bridge is created, ensure that the Internet connection is not part of the bridge.

• Avoid providing access to private network services. If they must be allowed, configure them via the Settings page for ICS, and only configure those services that are necessary.

• Harden the ICS host computer and, if at all possible, dedicate it to this task.

5. Managing ICS via Group Policy

By default, management of ICS is not restricted via Group Policy. A local administrator can enable the ICS, on a member computer. A good practice is to disable this service using Group Policy. The following two location-aware Administrative template policies can be configured to do so:

Prohibit use of Internet Connection Sharing on your DNS domain network.

When enabled, administrators cannot enable ICS on the local computer. When disabled or not configured, administrators can enable ICS on the local computer.

Prohibit installation and configuration of Network bridge on your DNS domain network.

When enabled, administrators cannot create a network bridge on the local computer. When disabled or not configured, administrators can create a network bridge on the local computer.

Location-aware policies operate only when a computer is connected to the same DNS domain network as the one it was connected to when the policy was refreshed. This means that administrators of laptop computers will not be able to enable ICS when the laptop is connected to its domain, but they will be able to enable ICS when the laptop is connected to a different network (such as a hotel or conference network).