Firewalls

An Internet firewall lets you take advantage of the services offered on the Internet, while limiting exposure to attack. A firewall may consist of a collection of hardware and software components that collectively provide a protected channel between networks with differing security. Potential paths to the private network are limited by configuring the firewall to accept only packets from Internet Protocol (IP) addresses and/or ports of the Transmission Control Protocol/Internet Protocol (TCP/IP) that have been designated by the system administrator.

For more information, see Chapter 20, "Internet Access and Tools."

Understanding Proxy Servers

The most critical component of your firewall is your proxy server. A proxy server listens to the computers on your internal network. When a client application makes a request, a proxy server responds by translating the request and passing it to the Internet. When a computer on the Internet responds, the proxy server passes that response back to the client application on the computer that made the request.

Proxy servers make a firewall safely permeable to users behind the secured entrance, while closing entryways in the private network to potential attacks. The proxy server must act as both a server and client. It serves proxy clients when accepting approved requests for external servers, and requests services from those servers on behalf of its clients. Proxy servers are commonly used by administrators of corporate networks connected to the Internet and by Internet Service Providers (ISPs).

Microsoft Proxy Server provides an easy, secure, and cost-effective way to bring Internet access to every desktop in an organization. Microsoft Proxy Server routes requests and responses between the Internet and client computers, acting as a liaison between them. In addition to routing requests, Microsoft Proxy Server provides a cache of frequently requested Internet sites, blocks access to specified sites, and provides secure access between your internal network and the Internet. It also offers firewall features.

Configuring Proxy Servers

Access to Web sites secured by Windows NT Challenge and Response requires that firewalls and proxy servers be configured to permit passage of Windows NT Challenge and Response.

If you want to use a proxy server or firewall to protect your local area network (LAN) from being accessed by others on the Internet, carry out the following steps, which set up your computer to gain access to the Internet through a firewall.

To set up a LAN proxy server or firewall

1. Run the Internet Connection Wizard.

   Click Start, point to Programs, point to Internet Explorer, and then click Connection Wizard.

2. Configure your computer to connect to the Internet by using TCP/IP on your LAN.
3. When you are prompted for the gateway address, type an address only if your organization uses gateways for routing information over the network.

   Note

   The gateway computer is not the same as the proxy server or firewall computer that protects your LAN from the Internet, so do not type your proxy server or firewall address here.

4. In Control Panel, double-click Internet, and then click the Connection tab.
5. In the Proxy server area, select the Access the Internet using a proxy server check box.
6. Click Advanced.
7. In the first text box, type the Hypertext Transfer Protocol (HTTP) server address for the computer you want to use as the proxy server. In the second text box, type the port number. An example of a proxy server and port number is http://myproxy.mycompany.com:80.

   In this example, you would type http://myproxy.mycompany.com in the first text box, and 80 in the second text box.

   You can use a different proxy for different types of addresses. However, if you want to use the same proxy for all types of addresses, make sure you select the Use the same proxy server for all protocols check box.

8. In the Exceptions area, click the text box, and then type the names of the computers, domains, and ports on the Internet that, when accessed, will not go through the proxy server. Separate each item you type with a semicolon (;). Local addresses are defined as those in which the server name does not have a period (.) in it.

   For example:

   • http://internalweb/ is a local address.
   • http://www.microsoft.com/ is not a local address.

   For Help on these items, click the ? in the title bar, and then click the item.

9. When you have finished changing settings, click OK.
10. Click OK to close the Internet properties in Control Panel.

If you are running Internet Explorer, restart your computer so that the new proxy settings can take effect.

Note

If you are setting up Internet Explorer with a SOCKS proxy server, you must set it up separately from other proxy information (for example, HTTP, FTP, or Gopher). In most cases, this means that all other proxy fields should be left blank and the SOCKS field should contain the address of your SOCKS proxy server. The only exception is when you are using a SOCKS proxy server and a different proxy (for example, HTTP) on the same connection.

For more information about proxy servers and firewalls, see Microsoft Proxy Servers Installation and Administration Guide.