Add a least-privilege inbound firewall rule and verify its scope
On a canned Windows host, add a least-privilege inbound firewall rule that allows RDP (TCP 3389) from the management subnet 192.0.2.0/24 only, then show the named rule to confirm its action, port, and remote scope. A host firewall rule protects this host only; it is one layer of defense in depth, not the network perimeter, and it does not protect other hosts. Do not claim this canned host is a real machine. This page teaches a job procedure. These are not exam questions, this is not a score predictor, and nothing here is taken from any certification exam.
Steps
- 1
Run netsh advfirewall firewall add rule name="Allow-RDP-from-Mgmt" dir=in action=allow protocol=TCP localport=3389 remoteip=192.0.2.0/24. netsh prints Ok. to confirm the rule was added.
- 2
Run netsh advfirewall firewall show rule name="Allow-RDP-from-Mgmt". Confirm Action Allow, LocalPort 3389, and RemoteIP 192.0.2.0/24 (scoped, not Any).
What you should see
The named rule shows Action Allow, LocalPort 3389, and RemoteIP 192.0.2.0/24. This scopes RDP to the management subnet on this host only; it does not protect other hosts or the network.