Skip to content

P01-T09 - AD Firewall Hardening

Objective

Replace the transitional lab DC-access allowances from P01-T07 with a more professional and future-proof CHR policy for Active Directory traffic, while preserving successful domain join, logon, DNS, DHCP relay, and SMB access.

Why this runbook exists

The P01-T07 rules intentionally open the minimum workstation-to-DC ports needed to bring the lab online quickly. That is acceptable for bring-up, but it remains a transitional profile tied to one workstation VLAN and one recovery sequence.

This runbook moves the design toward:

  • explicit allowed source networks
  • explicit denied source networks
  • explicit DC and file server role targets
  • preparation for future multinational site growth

Inputs

Key Value
Domain controller list HQ-DOMAIN-CONTROLLERS
File server list HQ-FILE-SERVERS
Managed workstation subnet 172.20.30.0/24
Managed hypervisor subnet 172.20.100.0/24
Guest subnet 172.20.70.0/24
DMZ subnet 172.20.80.0/24

Design stance

For this guide, the enterprise-ready posture is:

  • allow managed subnets to reach DCs
  • deny guest and DMZ to DCs explicitly
  • keep DC access broad enough to tolerate AD dependencies in a routed environment
  • tighten by source subnet first, not by pretending AD is easy to reduce to a tiny fixed-port list

This is deliberate. Active Directory uses RPC and other service patterns that make naive per-port hardening brittle. The first professional step is source-network restriction, not overconfident port minimization.

Target State

Property Value
Managed-to-DC policy Explicitly allowed
Guest-to-DC policy Explicitly denied
DMZ-to-DC policy Explicitly denied
SMB policy Still explicit to file servers
Default posture Final drop remains in effect

Prechecks

  • Complete P03-T01.
  • Confirm HQ-DC01 is operational and validated.
  • Confirm P01-T07 rules are currently in place and working.
  • Confirm the DHCP relay and its related input rules are already functional if Windows DHCP is serving another VLAN.
  • Confirm no duplicate transitional SMB rules exist from emergency recovery work:
/ip firewall filter print detail where comment~"SMB"

If duplicate FWD - Workstations to HQ-FS01 SMB TCP or FWD - Workstations to HQ-FS01 SMB UDP rules exist, remove the duplicate copies before hardening. Do not leave duplicate accept rules in the final CHR policy because they make counter-based validation ambiguous.

  • Export the current filter table before changing rule ordering:
/ip firewall filter print detail

Execution

  1. Create source-network address lists:
/ip firewall address-list
add list=AD-MANAGED-WORKSTATIONS address=172.20.30.0/24 comment="VLAN30 managed workstations"
add list=AD-MANAGED-HYPERVISORS address=172.20.100.0/24 comment="VLAN100 hypervisors"
add list=AD-BLOCKED-GUEST address=172.20.70.0/24 comment="VLAN70 guest"
add list=AD-BLOCKED-DMZ address=172.20.80.0/24 comment="VLAN80 dmz"
  1. Add explicit deny rules for domain controller access from untrusted subnets before the generic final drop:
/ip firewall filter
add chain=forward action=drop src-address-list=AD-BLOCKED-GUEST dst-address-list=HQ-DOMAIN-CONTROLLERS comment="FWD - Guest to DC Drop"
add chain=forward action=drop src-address-list=AD-BLOCKED-DMZ dst-address-list=HQ-DOMAIN-CONTROLLERS comment="FWD - DMZ to DC Drop"
  1. Add the managed-subnet rules that supersede the transitional workstation-to-DC rules from P01-T07:
/ip firewall filter
add chain=forward action=accept src-address-list=AD-MANAGED-WORKSTATIONS dst-address-list=HQ-DOMAIN-CONTROLLERS comment="FWD - Managed Workstations to DC"
add chain=forward action=accept src-address-list=AD-MANAGED-HYPERVISORS dst-address-list=HQ-DOMAIN-CONTROLLERS comment="FWD - Hypervisors to DC"
  1. Keep or remove the older transitional port-specific rules from P01-T07 only after confirming the new rules are above FWD - Default Drop and traffic counters increment correctly.

Do not remove the INPUT - DHCP Relay Client Requests or INPUT - DHCP Relay Server Replies rules during this step. They are part of the router-facing relay path, not the forward-path transition.

  1. Preserve explicit SMB allowances to file servers:
/ip firewall filter
:foreach RuleComment in={
    "FWD - Managed Workstations to SMB TCP";
    "FWD - Managed Workstations to SMB UDP"
} do={
    :local Seen false
    :foreach RuleId in=[find where chain=forward comment=$RuleComment] do={
        :if ($Seen = false) do={
            :set Seen true
        } else={
            remove $RuleId
        }
    }
}

:if ([:len [find where chain=forward comment="FWD - Managed Workstations to SMB TCP"]] = 0) do={
    add chain=forward action=accept src-address-list=AD-MANAGED-WORKSTATIONS dst-address-list=HQ-FILE-SERVERS protocol=tcp dst-port=445,139 comment="FWD - Managed Workstations to SMB TCP"
}
:if ([:len [find where chain=forward comment="FWD - Managed Workstations to SMB UDP"]] = 0) do={
    add chain=forward action=accept src-address-list=AD-MANAGED-WORKSTATIONS dst-address-list=HQ-FILE-SERVERS protocol=udp dst-port=137,138 comment="FWD - Managed Workstations to SMB UDP"
}

  1. Reorder rules so the effective sequence is:

  2. established/related

  3. invalid drop
  4. LAN to internet
  5. backup to servers
  6. explicit guest/dmz to DC drops
  7. explicit managed-subnet to DC allows
  8. explicit SMB allows
  9. guest isolation
  10. DMZ isolation
  11. final drop

Use an anchor-based reorder that always moves each rule immediately before FWD - Default Drop. Do not use absolute rule numbers. That approach is what was validated successfully on HQ-CHR01.

{
    :local DesiredOrder {
        "FWD - Guest to DC Drop";
        "FWD - DMZ to DC Drop";
        "FWD - Managed Workstations to DC";
        "FWD - Hypervisors to DC";
        "FWD - Managed Workstations to SMB TCP";
        "FWD - Managed Workstations to SMB UDP";
        "FWD - Guest Isolation";
        "FWD - DMZ Isolation"
    }

    :foreach RuleComment in=$DesiredOrder do={
        :foreach RuleId in=[/ip firewall filter find where comment=$RuleComment] do={
            :local DefaultDrop [/ip firewall filter find where comment="FWD - Default Drop"]
            /ip firewall filter move $RuleId $DefaultDrop
        }
    }
}

The validated forward chain on HQ-CHR01 after this operation was:

  1. FWD - Established
  2. FWD - Invalid
  3. FWD - LAN to Internet
  4. FWD - Backup
  5. FWD - Guest to DC Drop
  6. FWD - DMZ to DC Drop
  7. FWD - Managed Workstations to DC
  8. FWD - Hypervisors to DC
  9. FWD - Managed Workstations to SMB TCP
  10. FWD - Managed Workstations to SMB UDP
  11. FWD - Guest Isolation
  12. FWD - DMZ Isolation
  13. FWD - Default Drop

After this sequence is validated, remove the transitional P01-T07 workstation-to-DC rules with these comments if they still exist:

  • FWD - Workstations to DC DNS UDP
  • FWD - Workstations to DC DNS TCP
  • FWD - Workstations to DC Kerberos TCP
  • FWD - Workstations to DC Core UDP
  • FWD - Workstations to DC Core TCP
  • FWD - Workstations to DC RPC Dynamic

Do not remove the SMB rules unless they are being replaced by their managed-subnet equivalents in the same maintenance window.

Validation

  • HQ-CL01 and HQ-CL02 still log on to the domain.
  • DNS queries against HQ-DC01 still succeed from managed workstation subnets.
  • Workstations still obtain DHCP leases through the configured relay path.
  • Group Policy still applies.
  • SMB access to HQ-FS01 still succeeds.
  • Guest cannot reach the DC.
  • DMZ cannot reach the DC.
  • Filter counters increase on the new allow and deny rules.
  • Rule order matches the intended sequence exactly.
  • The rule-ordering script completes without invalid value for argument numbers or can not move object before itself.

Evidence

  • Output of /ip firewall filter print stats
  • Output of /ip firewall address-list print
  • Successful domain logon from HQ-CL01
  • Failed reachability test from a guest validation host to HQ-DC01

Rollback

  • Re-enable the older P01-T07 transitional workstation-to-DC rules temporarily if the new hardened rules break core AD functionality unexpectedly.
  • Do not remove the base firewall or NAT rules during rollback.