For enterprise environments, Microsoft recommends the use of a network firewall with intrusion protection, such as Microsoft Internet Security and Acceleration (ISA) Server. For more information, visit this Microsoft Web site.

For non-enterprise environments or for added protection, Microsoft recommends that you include and configure the Windows Embedded CE Firewall on the network device. For more information about the Windows Embedded CE IP Firewall and how to configure it, see Firewall.

For information about configuring the IP firewall to properly manage traffic destined for an internal network, see IP Firewall Reference.

If no firewall is present and enabled, enabling broadcast forwarding can pose a security threat to clients on a private network. Broadcast forwarding is required to support Network Address Translation (NAT) broadcast port mappings. To enable broadcast forwarding on your firewall-protected gateway device, under the [HKEY_LOCAL_MACHINE\COMM\Tcpip\Parms] registry key, set the ForwardBroadcasts registry value of type DWORD to 1.

Use authentication and user access lists for the Web server

The gateway, by default, does not implement different user privilege levels. Any user with physical access to the gateway device may be able to impact the device. To prevent potential attacks, it is important that you configure user permissions and access rights on the gateway Web server. Failing to do so could result in exposure of the device to remote attacks.

Use NTLM and/or a basic authentication mechanism to limit access to known users only. You can configure user access in the HKEY_LOCAL_MACHINE\COMM\HTTPD registry key. Carefully choose the virtual roots and limit access to the appropriate files by providing appropriate user access lists. Unknown users with access to the virtual root may be able to access files and directories within that virtual root. For more information, see Web Server Authentication and Permissions.

To maintain a log of all events that occur on the public and private side of your network, enable logging on your gateway device. For more information, see Gateway Logging.