Windows Forum

Ask something
Discussion Locked

Firewall Security for Terminal Server

0 helpful
4 replies

by pablob

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

As all users on a Windows Terminal Server (or Metaframe Server) have the same IP address, this causes a problem when trying to control access through a firewall because although the firewall can require the user to authenticate with username and password, successful authentication means that any subsequent IP connection from that user's source IP address will be allowed through the firewall - and everybody has the same IP address on a terminal server !

I have tried session and user authentication on Checkpoint FW1 and still have this problem. Setting authentication to per connection is not practical since with http this means every object on a page requires re-authenticating with is a major pain for users.

I need a solution that is going to be very robust and high performance, e.g. not MS Proxy server ;)- so if you have any ideas ......?

4 replies

by some guy in seattle

I've pondered this question for a while...and the only acceptable workaround I've found is to stick the terminal server in a DMZ and insist on user authentication to attach to the terminal server. Then allow outbound access from your Terminal Server to the internet for whatever services are desired.

Sorry this solution isn't more elegant, but sometimes we have to make these compromises.

Hope that helps -

by pablob

This still doesn't work as user auth on the firewall to attach to the TS basically allows connection to the server or not. It does not control what individuals have access to once they are logged in to the TS environment. e.g. Bob and Alice might both be allowed to attach to the TS, but Bob might require less restricted access to the outside world from the TS.

by pablob

Call me cynical but the words "Microsoft" and "Security" in the same sentence just don't go together ! The problem would also occur in a multi-user UNIX environment where all users are coming from the same source IP address e.g. multiple users of CDE with StarOffice and Netscape via Sun Ray appliances and a central SUN box. Surely there is a UNIX based firewall or embedded solution ?

This discussion is closed to new replies.