Network Location Types

Different types of networks require different levels of protection. For example, when connected to your internal AD DS network, you might want computers to allow network management tools to establish incoming connections. However, you do not want to allow management connections if a user connects to a wireless hotspot at an airport or coffee shop.

Windows Vista and Windows 7 provide three different network location types:

• Public With public networks, such as wireless hotspots, protecting the computer from network attacks is vital. Network Discovery is disabled by default for public networks, and Windows Firewall blocks all unrequested, incoming traffic unless you specifically create exceptions.
• Private (labeled as Home or Work) Private networks are designed to be used for home or small office networks, where you may want to share resources with other computers on the LAN, but you do not have an AD DS domain controller. Network Discovery is enabled by default on private networks.
• Domain Any time the computer can connect to and authenticate with an AD DS domain controller of the domain for which it is a member, the network is considered a domain network. Network Discovery is disabled by default on domain networks unless overridden by domain Group Policy settings. Administrators should use Group Policy settings to create Windows Firewall exceptions for internal monitoring and management software.

It is important to understand network location types because any Windows Firewall exceptions you create apply only to the currently configured network location type. For example, if you want Microsoft Internet Information Services (IIS) to accept incoming connections when you are connected to your home network, you should specify that the home network is a private network prior to creating the exception. If your home network is configured as a public network when you create the exception, IIS will be available when you are connected to public networks such as wireless hotspots, thereby exposing IIS to attacks from the Internet.

Domain networks are configured automatically when a computer connects to a domain controller. All other networks are considered public networks by default. To specify a network as the private location type, follow these steps:

1. Connect your computer to the network you want to configure as private.
2. Open Network And Sharing Center. Click Public Network, located below your active network connection.
3. The Set Network Location dialog box appears. Click Home or Work.
4. Click Close.

Because Windows might connect to many different networks, it stores profiles of each network using the network's Domain Name System (DNS) suffix and gateway media access control (MAC) address. The gateway MAC address uniquely identifies a network adapter in your router.