Monitoring Remote Servers Through Firewalls

Power Admin monitoring products contain a variety of modules that monitor different server resources. In general, the server resources are accessed through one of two ways:

  1. Standard protocol ports
  2. Windows RPC
  3. Windows SMB (file serving)

Standard Protocol Ports

Standard Protocol Ports would be those ports that are used by a protocol-specific monitor. For example, the Web Page monitor uses HTTP, and therefore (by default) port 80 to access the remote server. The SMTP server monitor uses a default port of 25, POP3 is a default of port 110, etc. These standard protocol monitors therefore use the port specified by the relevant standard.

Windows RPC

See below for Windows Firewall rules for Windows 2008 and Windows 2012.

Windows-specific monitors (Event Log monitor, Service monitor, Performance monitor, etc) use standard Windows RPC to access the underlying resources. Windows RPC uses TCP port 135 by default (although you can change this via tools on the Microsoft website). Because port 135 is targeted by much of the malware and worms on the Internet, we do not recommend opening that port on an Internet-facing firewall.

Besides port 135, RPC also uses a dynamic port range that gets established between the endpoints. Microsoft has more information, including firewall considerations:

Windows SMB

Windows disk-based monitors (Disk Space monitor, File & Directory Change monitor, etc) use standard Windows SMB to access the underlying files and directories. Windows SMB uses TCP port 445 by default (although you can change this via tools on the Microsoft website). Because port 445 is targeted by much of the malware and worms on the Internet, we do not recommend opening that port on an Internet-facing firewall.

Additional Information

Windows 2008

Windows 2008 comes with a very strict firewall which is enabled by default. Go to Control Panel -> Windows Firewall with Advanced Security to the incoming rules, and enable the Remote Administration rule to enable typical monitor access.

Windows 2012

The Windows 2012 firewall is very strict and tightly locked down in its default configuration. For monitoring the server, consider enabling the following rules:

Disk Space
File and Printer Sharing (SMB-In)
Event Log
Remote Event Log Management (RPC)
Remote Event Log Management (RPC-EPMAP)
Performance Counters
Performance Logs and Alerts (TCP-In)
Ping
File and Printer Sharing (Echo Request - ICMPv4-In)
Services
Remote Service Management (RPC)
Remote Service Management (RPC-EPMAP)
Inventory Collection
Windows Management Instrumentation (DCOM-In)
COM+ Network Access (DCOM-In)

A good overview of Windows network port usage is available at: Service overview and network port requirements for the Windows Server system

Testing

To test if the ports are correctly opened, we recommend using a Windows app, like the Windows Event Log Viewer for example. Start eventvwr.msc and see if you can use it to connect to and view the remote Event Log. If this works, any firewalls in between are letting the requests through. For advanced firewalls like the one in Windows Server 2012, you should also try this with the Services applet (services.msc) and the Performance viewer (perfmon.msc) if you will be monitoring those resources.

Downloads  |  Videos  |  Docs / FAQ  |  Support Forum  |  Compare Products  |  Blog  |  About Us    
   
 
Power Admin LLC
We are finished testing [PA Server Monitor] and are very pleased with every aspect of it ... [I like] routines for setup (could not be easier), pricing - compared to other products this is a bargain, interface, stability, reporting, and remote monitoring. The first week of use the program generated around a $1000 extra for us.
Thomas R., SysKon, Norway more customer quotes...
see customer list...