Firewall - Server 2012, 2016, 2019, 2022

The following information shows how you can open port 3389 on a Windows installation. However, quite often the Windows Firewall is under control of the anti-virus software or other security-related software. Therefore the following information might not always be applicable.

Automatically

AADServer can create and maintain Windows Firewall rules.
This option is available for Windows 10 and newer, and Windows Server 2016 and newer.

In case the option for Windows Firewall is selected, AADS creates and maintains the following Firewall rules:

Manually

Preparation

Try to find the "Control Panel" in Windows Server 2012, and select "Windows Firewall".

Enable the Windows Firewall.

Click on "Allow an app or feature through Windows Firewall"....

If required, click on the button "Change Settings" button, such that the list can be edited. Then de-select  "Remote Desktop" : it should  not  be selected.

After de-selecting both "Remote Administration" and "Remote Desktop", click on OK.

Create Port Rule

Select "Advanced Settings"

Select first "Inbound Rules", followed by "New Rule...."

Select "Port", and click on the "Next" button.

Enter the RDP portnumber of AADS Terminal Server, and click on the "Next" button.

Select "Allow the connection", and click on the "Next" button.

Select Domain, Private and Public, and click on the "Next" button.

Note: the option "Domain" might only be visible if the AADServer is joined to a Domain, and might not visible in case of a stand-alone AADS Terminal Server.

Enter the name "AADS-RDP", and click on the "Finish" button.

There should now be an "Inbound Rule" with the name "AADS RDP".

Change Port Rule

The RDP port number of the AADS Terminal Server is changed to 12345. This setting must also be done in the Windows Firewall:

Select the rule AADS-RDP, and select "Properties", followed by changing the "Local port" number to 12345.

AADServer in a Farm

When this Server is used in an AADS Farm, default it will be using port 3390 for the Farm-communication. The protocol is UDP:

Select first "Inboud Rules", followed by clicking on "New Rule...."

Select "Port", and click on the "Next" button.

Select UDP and enter 3390, and click on the "Next" button.

Select "Allow the connection", and click on the "Next" button.

Select Domain, Private and Public, and click on the "Next" button.

Enter the name "AADS-FARM-UDP", and click on the "Finish" button.

There should now be an "Inbound Rule" with the name "AADS-FARM-UDP".

Additional Firewall Security for the Farm

In the example above, the broadcast address for the Farm is 192.168.200.255. This implies that the Farm is running on the network-scope/range 192.168.200.0/255.255.255.0

It is possible to limit the Firewall rule "AADS-Farm-UDP" to the the network-scope/range 192.168.200.0/255.255.255.0, which is more secure:

• Select the rule "AADS-FARM-UDP" in the list "Inboud Rules"
• Edit the rule by clicking on "Properties"
• Click on "Scope"
• Select Remote IP Address, These IP Addresses
• Enter the "Subnet"