Eu não recomendo como o firewall por si só é realmente básico.
Ter um AD apenas para seu aplicativo da Web não é mais inseguro como se estivesse sob autenticação básica, mas verifique se há alguma dica (mesmo se marcado para 2008): Serviço de Domínio Active Directory na rede de perímetro (Windows Server 2008)
O Firewall do Windows é um pseudo-statefull para UDP, sem estado para ICMP & statefull para Ipv4, Ipv6 (para filtrar o tráfego, para inspecionar não encontrei nenhum documento, mas se o fizer, é realmente limitado).
O appliance de hardware geralmente é stateful.
com estado:
In computing, a stateful firewall (any firewall that performs stateful
packet inspection (SPI) or stateful inspection) is a firewall that
keeps track of the state of network connections (such as TCP streams,
UDP communication) traveling across it. The firewall is programmed to
distinguish legitimate packets for different types of connections.
Only packets matching a known active connection will be allowed by the
firewall; others will be rejected.
Stateful inspection, also referred to as dynamic packet filtering, is
a security feature often included in business networks. Check Point
Software introduced stateful inspection in the use of its FireWall-1
in 1994.1[2] https://en.wikipedia.org/wiki/Stateful_firewall
Sem estado:
Stateless firewalls watch network traffic, and restrict or block
packets based on source and destination addresses or other static
values. They are not 'aware' of traffic patterns or data flows. A
stateless firewall uses simple rule-sets that do not account for the
possibility that a packet might be received by the firewall
'pretending' to be something you asked for. - See more at:
http://www.inetdaemon.com/tutorials/information_security/devices/firewalls/stateful_vs_stateless_firewalls.shtml#sthash.iDNnjqWC.dpuf
Do TechNet:
Windows Firewall provides the stateful filtering of TCP/IP traffic
(IPv4 and IPv6) that uses the TCP transport protocol. It also provides
the “pseudo-stateful” filtering of TCP/IP traffic that uses the UDP
transport protocol. ICMP traffic is not statefully filtered; rather,
ICMP traffic is allowed or blocked based on Windows Firewall settings
(for example, you can explicitly allow or deny incoming echo requests
or outgoing destination unreachable messages by configuring Windows
Firewall settings). Because Windows Firewall is tied directly to the
TCP/IP architecture of Windows, it does not provide any filtering of
non-TCP/IP protocols, such as IPX/SPX or AppleTalk.
With the exception of some File Transfer Protocol (FTP) traffic,
Windows Firewall does not use Application layer information to
statefully filter traffic. FTP is a special case because of the way in
which an FTP server establishes the data channel for an FTP file
transfer. During a typical FTP user session, an FTP client initiates a
control channel with an FTP server. When the FTP client transfers a
file from the FTP server, the FTP server tries to establish a data
channel with the FTP client by initiating communication on a TCP port
different from the one used for the control channel. This can cause
most firewalls running on the FTP client computer to drop the data
channel packets coming from the server because they appear to be
unsolicited. To overcome this problem, Windows Firewall uses the
Application Layer Gateway Service to provide dynamic port mapping for
the FTP data channel, thereby facilitating the stateful filtering of
FTP traffic. https://technet.microsoft.com/en-us/library/cc755604(v=ws.10).aspx