Block 5 secures and protects the server infrastructure. We implement programmatic disaster recovery using Windows Server Backup (WSB) with wbadmin for Bare-Metal Recovery (BMR), and configure Windows Defender Firewall with Advanced Security across all three profiles (Domain, Private, Public) using custom granular allow rules for our lab services.

💡
Stateful Packet Inspection (SPI) Mechanics Windows Firewall is a stateful firewall. It inspects packet headers and maintains an internal state table for all established outbound sessions. When a client inside the lab queries an external web server, the return packets on ephemeral ports are automatically accepted without requiring a broad inbound firewall hole.

💾 Windows Server Backup & Bare-Metal Recovery (BMR)

Unlike legacy file-based backup utilities, modern wbadmin performs block-level Volume Shadow Copy Service (VSS) snapshots:

  • System State Backup: Captures Active Directory database, registry hives, boot files, COM+ class registration, and system certificate catalog.
  • Bare-Metal Recovery (-allCritical): Captures the OS partition, ESP (EFI System Partition), and Microsoft Reserved Partition, allowing complete recovery even to dissimilar bare-metal or a brand-new Hyper-V VM.

Step 1: Install Backup Feature & Automate Backup

# 1. Install Windows Server Backup Role & PowerShell Engine
Install-WindowsFeature -Name Windows-Server-Backup -IncludeManagementTools

# 2. Prepare Backup Target Directory
$backupDir = "C:\Backups"
if (-not (Test-Path $backupDir)) { New-Item -Path $backupDir -ItemType Directory | Out-Null }

# 3. Trigger Automated Bare-Metal System Backup
wbadmin start backup -backupTarget:$backupDir -include:C: -allCritical -quiet

🛡 Custom Inbound Firewall Rules Matrix

We enforce a default-deny posture and explicitly whitelist our lab services:

Rule Display Name Protocol Local Port(s) Scope Profile Target Service
Lab: Allow DNS (UDP 53) UDP 53 Domain, Private, Public DNS Server Name Resolution
Lab: Allow DNS (TCP 53) TCP 53 Domain, Private, Public DNS Zone Transfers & Large Payloads
Lab: Allow HTTP TCP 80, 8080 Domain, Private, Public IIS Default & Portal Websites
Lab: Allow HTTPS TCP 443 Domain, Private, Public Secure Web (TLS/SSL)
Lab: Allow FTP Control TCP 21 Domain, Private, Public FTP Authentication & Commands
Lab: Allow FTP Data Range TCP 50000-50100 Domain, Private, Public FTP Passive Mode (PASV) Data
Lab: Allow iSCSI Target TCP 3260 Domain, Private, Public iSCSI SAN Block Storage Target
Lab: Allow DHCP Server UDP 67 Domain, Private, Public DHCP Lease Broadcast Inbound
Lab: Allow ICMPv4 Echo ICMPv4 Type 8 (Echo) Domain, Private, Public Network Ping & Diagnostics

Step 2: Apply Advanced Firewall Rules

# 1. Enforce Firewall on Domain, Private, and Public Profiles
Set-NetFirewallProfile -Profile Domain, Private, Public -Enabled True

# 2. Provision Custom Inbound Service Allow Rules
$rules = @(
    @{ Name = "Lab-Allow-DNS-UDP";     Port = 53;              Protocol = "UDP" },
    @{ Name = "Lab-Allow-DNS-TCP";     Port = 53;              Protocol = "TCP" },
    @{ Name = "Lab-Allow-HTTP";        Port = @(80, 8080);     Protocol = "TCP" },
    @{ Name = "Lab-Allow-HTTPS";       Port = 443;             Protocol = "TCP" },
    @{ Name = "Lab-Allow-FTP-Control"; Port = 21;              Protocol = "TCP" },
    @{ Name = "Lab-Allow-FTP-Data";    Port = "50000-50100";   Protocol = "TCP" },
    @{ Name = "Lab-Allow-iSCSI";       Port = 3260;            Protocol = "TCP" },
    @{ Name = "Lab-Allow-DHCP";        Port = 67;              Protocol = "UDP" }
)

foreach ($r in $rules) {
    New-NetFirewallRule -Name $r.Name -DisplayName $r.Name -Direction Inbound -Action Allow -Protocol $r.Protocol -LocalPort $r.Port -Profile Any
}

# 3. Allow ICMPv4 (Ping)
New-NetFirewallRule -Name "Lab-Allow-ICMPv4" -DisplayName "Lab: Allow ICMPv4" -Direction Inbound -Action Allow -Protocol ICMPv4 -IcmpType 8

Step 3: Verification & Port Accessibility Audit

& ".\scripts\05_Block5_Backup_Firewall\Verify-Block5.ps1"
← Previous Block 4: DHCP Scope & FTP