Router on Windows, do I need firewalls on the internal network?

Question

firewall

Good day!
Currently, our team is mastering the basics of building private cloud offices (based on VDI vmware technology) and everything went smoothly until we ran into the infrastructure of our first customer. And the bottom line is this: in a standard office, some infrastructure has been deployed (we will discuss it later), which has been managed by the same administrator for several decades, whose position is the credo "do not touch anything while it works." So, when integrating a cloud office with a physical one, a number of flaws were discovered: constant RDP attacks, a disabled firewall, a half-working (everything except file antivirus is disabled) casper, etc. We, as a decent team, began to fix all the jambs: we wound up an analogue of fail2ban for RPD, turned on the firewall and set up Casper, changed passwords to 128-bit ones, and so on and on and on. And then the Internet is cut off in the office! The problem is found quite quickly: there is a server on Windows 2012R2 operating system that acts as a router (and not through RRAS, but through “Internet Connection Sharing”), and it’s on it that the firewall of the internal network is not configured and cuts off the Internet. All this, of course, was quickly put in order, but a number of questions arose:
1. Is it reasonable to raise a whole Windows Server 2012 R2 server for "Internet Connection Sharing" (we do such things on Linux with 512MB of RAM);
2. Do I need to configure firewalls on the internal network? (as I see the attack vector “a virus that is not in the virus signature database gets into the internal network --> uncontrolled network impact of malware on the internal resources of the company --> information security breach”).

Answer 1

As it should:
a separate router at the edge, servers and all components that work with the outside world directly - in a separate DMZ zone, between the DMZ and the internal network - statefull fw. On the windows ISA proxy for internal users, direct routing between office PCs, DMZ and the outside world is prohibited. All this economy is desirable to reserve.
How can aka a budget collective farm option:
One Linux server, aka stateless fw, preferably a proxy on it, nat is less desirable. Throw out the Windows server altogether. Separate servers with a vlan from users. Direct routing between all components is allowed, accesses are cut by iptables.
How will it be.
The local admin will go to the management and say that I don’t know how to manage all this, two more people are needed to manage this economy. he will also help the management to draw up the TOR and the acceptance test methodology (if he even knows what it is). The management will be imbued and put you demands under his tune.

Answer 2

1. I never understood people distributing the Internet and routing to Windows Server. Even Kerio on Windows caused terrible heartburn.
2. Ideally, the internal network should be divided into vlan, servers should live separately, office computers should be separate (sometimes the office is divided into departments on different subnets), wifi guests should also be separate and all this should be flavored with a good portion of acl. And on servers rigid division and control of access.

Answer 3

1. Inappropriate. It is easier in all respects (hardware, licenses, support) to make a linux-box router. There are a lot of manuals on the net on this issue, there are not many cases, any administrator can handle it. There are also special distributions with a web console, it will not be more difficult to manage Windows. and there are much fewer vulnerabilities than with a Windows server.
2. Necessary. The network perimeter is now very blurred, and not only a virus can be a threat on the internal network, but also the user himself or the one who pretends to be one. Everything that users do not need should be closed with a firewall or disabled.

Answer 4

1. It all depends on the specific task and skills in administration, if it is possible to implement it on unix-like, then it is better to do the router there, if only because opensource, there is no additional load on the machine except for fw, within the local office on unix- router is fine for a computer with 1cpu/512RAM. in the case of windows-gate, you need a license for windows Server and you must comply with the hardware requirements.
2. Necessary. Ideally, there should be a network security policy in which ACLs are declared on ports for specific machines, accounting can go, for example, on ports 8080,8090 to bank-client domains, etc., but the manager does not, this is a policy to the outside world, in the internal network you also need comply with the security policy, technically, of course, you can plug in smart switches everywhere and hardcode mac-ip, and issue ACLs on switches - this is up to protection against attacks with a compromised OS, also set up security at the switch level - spanning tree, protection against arp-spoof, unicast / multicast storm, but the administrator can also configure domain firewall rules, which in general will be a positive solution for traffic differentiation, you can also sniff suspicious IPS / IDS activity on the local network.