What you will do: see which ports on your server can be reached from the internet, and restrict the risky ones so that only your office network (and, if you use Prixl Guard, your Secure Access staff) can reach them. You do this from the Open Ports tab of the Warden dashboard.
Time: about 10 minutes.
You need: an administrator account on the server; Warden installed; a list of who connects to this server from outside the office and how; and a second way into the server (cloud console, IPMI/iLO or someone at the physical keyboard) in case a change cuts off your own connection.
Read this before you restrict anything
- There is no undo button on this tab. The only actions are LAN only and LAN + Guard. Once a port is restricted, the tab has no button to open it to the internet again. If you need a restriction removed, contact support through the contact form.
- Restricting a port blocks all internet access to it. If you, a staff member working from home or your IT vendor connect to this server over the internet through that port, that connection stops working.
- For Remote Desktop, use the Secure Access tab instead. The Lock RDP to Secure Access only switch has its own safety settings. See Lock Remote Desktop to Secure Access only.
- For SMB (445) and WinRM (5985, 5986) the Hardening tab offers the same two choices as a fix, in a Restrict mode drop-down. Fixes applied there are listed under Previously Applied with a Revert button. Applying fixes needs a paid plan. This is a separate route, not a way to undo a restriction made on the Open Ports tab. See Run the security audit and apply fixes.
LAN only or LAN + Guard?
| Button | Who can still reach the port | When to use it |
|---|---|---|
| LAN only | Computers on your office network. Staff connected through Prixl Guard cannot reach it. | Services only used inside the office, such as shared folders or a database used by office PCs. |
| LAN + Guard | Your office network plus staff connected through Prixl Guard Secure Access. | Services that staff working from home also need. The button is greyed out until at least one Guard invite has been created and redeemed. |
The dashboard explains what happens underneath: “Restricting a port creates a firewall allow rule for your local network and Secure Access peers, and a block rule for all internet IPs. The block rule overrides any application allow rules.”
Steps
- On the server, double-click the Prixl Warden Dashboard icon on the desktop and click Yes at the Windows permission prompt.
- In the left-hand menu, click Open Ports. The Listening Ports table opens.
- Click Refresh so the table shows the ports as they are right now.
- Read the Exposure column for each row, using the table further down this page. Rows marked Internet (in red) are the ones that can be reached from outside.
- For each Internet row, decide whether anyone outside the office needs that port. If you are not sure what a port is for, ask your IT vendor before you change it.
- On that row, click LAN only or LAN + Guard.
- The dashboard asks you to confirm: “Restrict port [port]/[protocol] to LAN only? This blocks all internet access to this port.” (it names LAN + Guard if you chose that). Read it, then confirm.
- To restrict another port, wait for the Next action in Ns badge at the bottom of the left-hand menu to clear. The dashboard allows one change at a time with a short pause between them.
- Click Refresh again when you have finished.
What the Exposure column means
| Exposure | Meaning |
|---|---|
| Internet | The firewall lets the internet reach this port. Decide whether it should. |
| LAN / Guard only | Only your office network and Guard staff can reach it. |
| Restricted: LAN only | Restricted by Warden to the office network. |
| Restricted: LAN + Guard | Restricted by Warden to the office network and Guard staff. |
| Closed (no rule) | A program is listening, but no firewall rule lets traffic in. |
| Localhost only | Only programs on the server itself can reach it. |
| Guard VPN listen port | Prixl Guard’s own port. Its action reads “Reserved by Warden” and cannot be changed here. |
Check it worked
- The port’s Exposure now reads Restricted: LAN only or Restricted: LAN + Guard, and the rule shows Managed by Warden.
- From a PC in the office, check that the service on that port still works (for example, open a shared folder if you restricted 445).
- If you chose LAN + Guard, ask a staff member connected through Guard to check the same service.
If something goes wrong
- LAN + Guard is greyed out: its tooltip reads “Configure at least one Guard peer (create + redeem an invite) to enable this option”. Invite a staff member first: Invite a staff member.
- Someone outside the office lost access after a restriction: there is no undo button on this tab. Contact support through the contact form with the server name and the port number.
- You cut off your own remote connection: get into the server another way (cloud console, IPMI/iLO or the physical keyboard), then contact support.
- For anything else, see Troubleshooting Warden.