Apologies for the delay, busy day.
There are a few ways you can approach this, it really depends how you feel about creating rules.
Option 1 - Don’t make any changes to the default settings in CIS, and place the firewall in ‘Training’ mode
Option 2 - Remove the default firewall rules, increase the Firewall security Level to custom Policy and Alerts to Very high. Manually create rules from the captured data.
Option 3 - Similar to Option 2 but make life a bit easier for ourselves.
Under the Stealth Port Wizard, Select ‘Alert me to incoming connections and make my ports stealth on a per case basis’
Personally, I’m not a great fan of the ‘Training’ mode option, It’s going to capture a lot of junk you don’t need and you won’t learn a great deal. It also doesn’t do what one might expect. Option 2 Is the most difficult, as it requires some knowledge of the underlying system processes and rule creation. Option 3 is principally the same as option 2, but we create a few rules up front, so we’re not inundated with lots of indecipherable information.
As far as requirements go, at least for the purpose of getting DC established and clients connecting:
Server: Firewall requirements for system processes:
Svchost.exe
System.exe
dns.exe
lsass.exe
tcpsvcs.exe
Wins.exe
You also need to make sure RPC (RCP Port 135), NetBIOS (TCP-UDP Ports 137 to 139) and SMB (TCP Port 445) traffic has full LAN access.
In addition to the above, depending upon your environment, you may also need to allow for LDAP, FRS and AD replication as well as Kerberos authentication.
Client: requirements for system processes:
Svchost.exe
System.exe
Lsass.exe
ping.exe
w32tm.exe
The same consideration must also be made for NetBIOS and SMB traffic.
To allow our DC and clients to talk to one another, we need to allow communication to take place both inbound and outbound. To achieve this in CIS we make use of Application rules for controlling the outbound flow and Global rules for controlling the inbound flow.
We could create separate, unique rules, to cater for each service and protocol requirement, however, that’s laborious and unnecessary. Instead we will create a couple of rules for each service that meets our needs.
First we need to make sure we have a correctly defined Network Zone that corresponds to our LAN IP block. For example, if the IP addresses we use on our LAN are from the 192.168 range, we can create a Network Zone called LAN with the IP address of 192.168.1.1 and the Net mask or 255.255.255.0. This will cater for all devices with an IP address between 192.168.1.1 and 192.168.1.255. If you have left CIS in it’s default state, it should, upon first use, identify and create this Zone for you.
Now we have a LAN Zone, we can create a pair of rules for each of the services we identified above. for example System.exe:
Allow IP OUT From ANY to LAN where protocol is ANY
Allow IP IN From LAN to ANY where protocol is ANY
These two rules will allow all traffic between all stations on the LAN
If you create this pair of rules for each or the services listed above, with the exception of WINS (see later paragraph), you’re pretty much covered for Application rules. For Global rules, create the same pair or rules and place them at the top of the list. Block rules may then be placed below.
For WINS you need to create a rule that allows:
Allow UDP OUT From ANY to 224.0.1.24 where Destination Port is 42
In addition to the aforementioned rules, you will find, on the DC at least, most services will require a loopback rule for LDAP:
Allow TCP OUT From 0.0.0.0 to 127.0.0.1 where Destination Port is 389
Svchost.exe will also require a loopback rule for RPC:
Allow TCP OUT from 0.0.0.0 to 127.0.0.0 where Destination Port is 135
Create the same pair of rules for each of the services listed under Client, above. It’s less important to have this pair of rules listed under Global, as most of the traffic from the client is outbound and the firewall supports stateful packet inspection. That said, there’s no harm and possibly even benefit by including these.
You will also need to allow ping.exe and w32tm.exe:
PING.exe - Allow ICMP OUT From ANY to [Your DC]
w32tm.exe - Allow TCP OUT From ANT to {Your DC] where Destination Port is 123
As stated above, you could tighten these rules by making them more explicit, for example, In Global rules only allowing inbound traffic for DNS.
I hope this helps. Don’t forget, these are just the basics, enough to get a DC running and clients connecting. if you add additional services, you will require additional rules.
Good luck.