Monitoring Remote Servers Through Firewalls
Power Admin monitoring products contain a variety of modules that monitor different server resources. In general, the server resources are accessed through one of two ways:
- Standard protocol ports
- Windows RPC
- Windows SMB (file serving)
Standard Protocol Ports
Standard Protocol Ports would be those ports that are used by a protocol-specific monitor. For example, the Web Page monitor uses HTTP, and therefore (by default) port 80 to access the remote server. The SMTP server monitor uses a default port of 25, POP3 is a default of port 110, etc. These standard protocol monitors therefore use the port specified by the relevant standard.
Windows-specific monitors (Event Log monitor, Service monitor, Performance monitor, etc) use standard Windows RPC to access the underlying resources. Windows RPC uses TCP port 135 by default (although you can change this via tools on the Microsoft website). Because port 135 is targeted by much of the malware and worms on the Internet, we do not recommend opening that port on an Internet-facing firewall.
Besides port 135, RPC also uses a dynamic port range that gets established between the endpoints. Microsoft has more information, including firewall considerations:
- How to configure RPC dynamic port allocation to work with firewalls
- Allowing in-bound traffic that uses dynamic RPC
Windows disk-based monitors (Disk Space monitor, File & Directory Change monitor, etc) use standard Windows SMB to access the underlying files and directories. Windows SMB uses TCP port 445 by default (although you can change this via tools on the Microsoft website). Because port 445 is targeted by much of the malware and worms on the Internet, we do not recommend opening that port on an Internet-facing firewall.
Windows 2008 comes with a very strict firewall which is enabled by default. Go to Control Panel -> Windows Firewall with Advanced Security to the incoming rules, and enable the Remote Administration rule to enable typical monitor access.
The Windows 2012 firewall is very strict and tightly locked down in its default configuration. For monitoring the server, consider enabling the following rules:
- Disk Space
- File and Printer Sharing (SMB-In)
- Event Log
- Remote Event Log Management (RPC)
Remote Event Log Management (RPC-EPMAP)
- Performance Counters
- Performance Logs and Alerts (TCP-In)
- File and Printer Sharing (Echo Request - ICMPv4-In)
- Remote Service Management (RPC)
Remote Service Management (RPC-EPMAP)
- Inventory Collection
- Windows Management Instrumentation (DCOM-In)
COM+ Network Access (DCOM-In)
A good overview of Windows network port usage is available at: Service overview and network port requirements for the Windows Server system
To test if the ports are correctly opened, we recommend using a Windows app, like the Windows Event Log Viewer for example. Start eventvwr.msc and see if you can use it to connect to and view the remote Event Log. If this works, any firewalls in between are letting the requests through. For advanced firewalls like the one in Windows Server 2012, you should also try this with the Services applet (services.msc) and the Performance viewer (perfmon.msc) if you will be monitoring those resources.