設定Windows Server 2003內建之防火牆
1.2.6 設定Windows Server 2003內建之防火牆
1.2.6.1 因為Windows Server 2003安裝完成後，都有啟用(enable)防火牆，由於要提供其它用戶端存取，

1.2.6.2 進入「進階設定」，放開(permit)HTTPS、HTTP與SMTP，這三個服務一定要開放出來。

1.2.6.3 Windows的防火牆有一個記錄檔(預設名稱C:\windows\pfirewall.log)可以供查測。
表 6-2 C:\windows\pfirewall.log
#Version: 1.5
#Software: Microsoft Windows Firewall
#Time Format: Local
#Fields: date time action protocol src-ip dst-ip src-port dst-port size tcpflags tcpsyn tcpack tcpwin icmptype icmpcode info path

2007-11-20 17:06:02 DROP TCP 211.189.50.38 220.132.232.73 6000 1433 40 S 1089011712 0 16384 - - - RECEIVE
2007-11-20 17:06:23 DROP UDP 0.0.0.0 255.255.255.255 68 67 328 - - - - - - - RECEIVE
2007-11-20 17:06:27 DROP UDP 0.0.0.0 255.255.255.255 68 67 328 - - - - - - - RECEIVE
2007-11-20 17:06:32 DROP TCP 222.216.28.160 220.132.232.73 6000 8080 40 S 1089011712 0 16384 - - - RECEIVE
2007-11-20 17:06:35 DROP UDP 0.0.0.0 255.255.255.255 68 67 328 - - - - - - - RECEIVE
2007-11-20 17:06:51 DROP UDP 0.0.0.0 255.255.255.255 68 67 328 - - - - - - - RECEIVE
2007-11-20 17:06:51 DROP UDP 0.0.0.0 255.255.255.255 68 67 328 - - - - - - - RECEIVE
2007-11-20 17:19:15 OPEN-INBOUND TCP 220.130.67.4 220.132.232.73 2175 80 - - - - - - - - -
2007-11-20 17:19:15 OPEN-INBOUND TCP 220.130.67.4 220.132.232.73 6768 80 - - - - - - - - -
2007-11-20 17:19:16 OPEN-INBOUND TCP 204.246.129.196 220.132.232.73 50333 80 - - - - - - - - -
2007-11-20 17:19:16 CLOSE TCP 220.132.232.73 204.246.129.196 80 50333 - - - - - - - - -
2007-11-20 17:19:17 DROP UDP 169.254.52.181 169.254.255.255 138 138 234 - - - - - - - RECEIVE
2007-11-20 17:19:20 DROP UDP 0.0.0.0 255.255.255.255 68 67 328 - - - - - - - RECEIVE
2007-11-20 17:19:23 DROP UDP 169.254.52.181 169.254.255.255 138 138 229 - - - - - - - RECEIVE
2007-11-20 17:19:28 DROP UDP 0.0.0.0 255.255.255.255 68 67 328 - - - - - - - RECEIVE
2007-11-20 17:19:31 DROP UDP 0.0.0.0 255.255.255.255 68 67 328 - - - - - - - RECEIVE
2007-11-20 17:19:37 DROP UDP 0.0.0.0 255.255.255.255 68 67 328 - - - - - - - RECEIVE
2007-11-20 17:19:40 DROP UDP 0.0.0.0 255.255.255.255 68 67 328 - - - - - - - RECEIVE
2007-11-20 17:19:56 DROP UDP 0.0.0.0 255.255.255.255 68 67 328 - - - - - - - RECEIVE
2007-11-20 17:20:16 CLOSE TCP 220.132.232.73 220.130.67.4 80 2175 - - - - - - - - -
2007-11-20 17:20:16 CLOSE TCP 220.132.232.73 220.130.67.4 80 6768 - - - - - - - - -

例如下圖這一筆記錄表示DROP一個TCP連線，由202.39.166.37(client)連到220.132.232.73(HTTP Server 80)。

1.2.6.4 新放開(permit)一個SSL HTTPS 443的連接Port，並允許來自Internet上所有電腦連上。

1.2.6.5 設定SMTP虛擬伺服器開放轉送的對象，此LAB只由本機上發送MAIL，所以不開放其他電腦使用這台主機來做轉送 此項目如果沒有設定時 會被當做SPAM廣告信的跳板，不可不慎。