Networking, DHCP, firewall and remote access

1. Configure and troubleshoot #

Networking cmdlets.

IP configuration #

Get-NetIPConfiguration                     # vue d'ensemble (équivalent moderne d'ipconfig /all)
Get-NetAdapter | Format-Table Name, Status, LinkSpeed, MacAddress
New-NetIPAddress -InterfaceAlias 'Ethernet' -IPAddress 10.0.10.21 -PrefixLength 24 -DefaultGateway 10.0.10.1
Set-DnsClientServerAddress -InterfaceAlias 'Ethernet' -ServerAddresses 10.0.10.10, 10.0.10.11
Set-NetIPInterface -InterfaceAlias 'Ethernet' -Dhcp Enabled                         # repasser en DHCP
Rename-NetAdapter -Name 'Ethernet' -NewName 'LAN'

Good practice: Give servers a static IP address (or a DHCP reservation), and use internal DNS (domain controllers) on every domain machine.

Layered troubleshooting #

Test-NetConnection srv-web01 -Port 443 -InformationLevel Detailed
Get-NetTCPConnection -State Listen | Sort-Object LocalPort |
    Select-Object LocalAddress, LocalPort, @{n='Processus'; e={(Get-Process -Id $_.OwningProcess).Name}}
Resolve-DnsName corp.exemple.fr -Type SOA ; Clear-DnsClientCache
Get-NetRoute -AddressFamily IPv4 | Where-Object DestinationPrefix -eq '0.0.0.0/0'

2. The DHCP service #

Handing out addresses automatically.

Install and configure DHCP #

Install-WindowsFeature DHCP -IncludeManagementTools
Add-DhcpServerInDC -DnsName srv-dc01.corp.exemple.fr -IPAddress 10.0.10.10      # autoriser le serveur dans AD
Add-DhcpServerv4Scope -Name 'LAN Paris' -StartRange 10.0.20.100 -EndRange 10.0.20.250 -SubnetMask 255.255.255.0 -LeaseDuration 8.00:00:00
Set-DhcpServerv4OptionValue -ScopeId 10.0.20.0 -Router 10.0.20.1 -DnsServer 10.0.10.10, 10.0.10.11 -DnsDomain corp.exemple.fr
Add-DhcpServerv4Reservation -ScopeId 10.0.20.0 -IPAddress 10.0.20.50 -ClientId 'AA-BB-CC-11-22-33' -Name 'Imprimante-RDC'
Get-DhcpServerv4ScopeStatistics                                                  # taux d'occupation
Add-DhcpServerv4Failover -Name 'FO-Paris' -PartnerServer srv-dc02 -ScopeId 10.0.20.0 -LoadBalancePercent 50 -SharedSecret (Read-Host)

Good to know: DHCP failover shares scopes between two servers, in load balancing or hot standby: no more “80/20” rule. On another subnet, a DHCP relay (IP helper) on the router forwards requests.

3. Windows Firewall #

Block by default, open precisely.

Profiles and rules #

Get-NetFirewallProfile | Format-Table Name, Enabled, DefaultInboundAction, DefaultOutboundAction
Get-NetConnectionProfile                                              # profil actif de chaque réseau
New-NetFirewallRule -DisplayName 'APP - API métier 8443' -Direction Inbound -Protocol TCP -LocalPort 8443 `
    -RemoteAddress 10.0.20.0/24 -Profile Domain -Action Allow
Get-NetFirewallRule -DisplayGroup 'Bureau à distance' | Enable-NetFirewallRule      # « Remote Desktop » en anglais
Set-NetFirewallProfile -Profile Domain, Private, Public -LogBlocked True -LogFileName '%SystemRoot%\System32\LogFiles\Firewall\pfirewall.log'

Common mistake: Disabling the firewall “to test” and forgetting to turn it back on, or opening a port to every address. Create a precise rule (port, protocol, source addresses, profile) and manage the firewall by GPO across the estate.

4. Remote access #

RDP, WinRM and SSH.

Remote Desktop, WinRM and OpenSSH #

# Bureau à distance avec NLA
Set-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -Value 0
Set-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -Value 1
Enable-NetFirewallRule -DisplayGroup 'Bureau à distance'

# OpenSSH Server
Get-WindowsCapability -Online -Name OpenSSH.Server*                  # préinstallé sur Windows Server 2025
Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0       # versions antérieures
Set-Service sshd -StartupType Automatic ; Start-Service sshd
ssh admin@srv-fs01 ; scp .\outil.zip admin@srv-fs01:C:/Temp/

Common mistake: Exposing port 3389 (RDP) to the Internet: it is one of the main ransomware entry points. Go through a VPN, a Remote Desktop Gateway or a bastion, with multi-factor authentication.

Commands to know #