If you use TCP/IP on your intranet, you can create a firewall in the computer running Windows NT Server by disabling internal TCP/IP routing. And you can still provide Internet Information Server services to both intranet and Internet users.
Figure 3.11 Disabled TCP/IP router security
TCP/IP routing controls whether data is passed to and from the intranet through the computer running Windows NT Server; that is, it controls whether the computer acts as a gateway, as shown in Figure 3.11.
The router feature works both ways. Either traffic can pass in both directions or traffic cannot pass through the server at all. This security model has all the advantages and disadvantages of the protocol isolation model.
A major concern with this model is that the separation between the Internet and your intranet depends on a single option in the TCP/IP configuration (or in the associated Registry entry). An intruder who somehow enters through your computer running Windows NT Server needs to change only one Registry value to expose your internal TCP/IP-based intranet.
If you use this security model, you need to be especially careful to control physical and administrative access to the computer that runs Internet Information Server. An individual familiar with Windows NT configuration tools and administrative permissions can find and change the Router check box in a matter of minutes.